# CVEs published 2026-09-18

513 CVEs were published on September 18, 2026: 51 critical, 211 high. Days are UTC.

- [CVE-2026-77875](https://cve.now/CVE-2026-77875.md): Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage (CVSS 6.8, QUANTUMTECH Hide Photos - Secure vault)
- [CVE-2026-93923](https://cve.now/CVE-2026-93923.md): SiYuan through 3.8.4 Stored XSS via Heading Style Attribute (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-93922](https://cve.now/CVE-2026-93922.md): SiYuan through 3.8.4 Stored XSS via notebook names (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-93921](https://cve.now/CVE-2026-93921.md): SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint (CVSS 5.3, siyuan-note siyuan)
- [CVE-2026-75885](https://cve.now/CVE-2026-75885.md): Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint (CVSS 9.3, Red Hat OpenShift Container Platform)
- [CVE-2026-93740](https://cve.now/CVE-2026-93740.md): Totolink A3002MU formWlEncrypt buffer overflow (CVSS 10.0, Totolink A3002MU)
- [CVE-2026-93739](https://cve.now/CVE-2026-93739.md): Totolink A3002MU formWlAc buffer overflow (CVSS 9.4, Totolink A3002MU)
- [CVE-2026-93738](https://cve.now/CVE-2026-93738.md): Totolink A3002MU formSchedule buffer overflow (CVSS 9.4, Totolink A3002MU)
- [CVE-2026-88097](https://cve.now/CVE-2026-88097.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Edge)
- [CVE-2026-61670](https://cve.now/CVE-2026-61670.md): microsandbox: Secret values exposed in world-readable process arguments (CVSS 6.5, superradcompany microsandbox · microsandbox)
- [CVE-2026-68928](https://cve.now/CVE-2026-68928.md): Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode (CVSS 8.6, Acode-Foundation Acode)
- [CVE-2026-85271](https://cve.now/CVE-2026-85271.md): Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857) (CVSS 6.1, openedx-platform)
- [CVE-2026-93894](https://cve.now/CVE-2026-93894.md): In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. (CVSS 2.3, Vinyl-Cache Vinyl Cache · Varnish-Software Varnish Cache)
- [CVE-2026-85272](https://cve.now/CVE-2026-85272.md): Open edX Platform: Path traversal via prefix-bypass in safe\_extractall Path Validation (CVSS 4.3, openedx-platform)
- [CVE-2026-71855](https://cve.now/CVE-2026-71855.md): Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state (CVSS 5.9, OISF suricata)
- [CVE-2026-71418](https://cve.now/CVE-2026-71418.md): Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption (CVSS 7.5, OISF suricata)
- [CVE-2026-57223](https://cve.now/CVE-2026-57223.md): Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation (CVSS 7.0, OISF suricata)
- [CVE-2026-63446](https://cve.now/CVE-2026-63446.md): Suricata app-layer: passed flows can retain transactions, causing resource exhaustion (CVSS 7.5, OISF suricata)
- [CVE-2026-63447](https://cve.now/CVE-2026-63447.md): Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption (CVSS 7.5, OISF suricata)
- [CVE-2026-63448](https://cve.now/CVE-2026-63448.md): Suricata smb: some SMB flows can cause resource exhaustion (CVSS 5.9, OISF suricata)
- [CVE-2026-57229](https://cve.now/CVE-2026-57229.md): Suricata smtp/mime: incomplete state reset allows detection bypass (CVSS 5.3, OISF suricata)
- [CVE-2026-57225](https://cve.now/CVE-2026-57225.md): Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading (CVSS 3.3, OISF suricata)
- [CVE-2026-63452](https://cve.now/CVE-2026-63452.md): Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption (CVSS 7.5, OISF suricata)
- [CVE-2026-63451](https://cve.now/CVE-2026-63451.md): Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load (CVSS 3.3, OISF suricata)
- [CVE-2026-57227](https://cve.now/CVE-2026-57227.md): Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages (CVSS 7.5, OISF suricata)
- [CVE-2026-63450](https://cve.now/CVE-2026-63450.md): Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection (CVSS 3.7, OISF suricata)
- [CVE-2026-93562](https://cve.now/CVE-2026-93562.md): Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling (CVSS 6.5, Red Hat Build of Debezium · Red Hat build of Quarkus 3.… +11)
- [CVE-2026-93574](https://cve.now/CVE-2026-93574.md): Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing (CVSS 6.5, Red Hat Build of Debezium · Red Hat build of Quarkus 3.… +11)
- [CVE-2026-63449](https://cve.now/CVE-2026-63449.md): Suricata sip: large SIP message bodies can evade detection with frame keyword (CVSS 3.7, OISF suricata)
- [CVE-2026-57228](https://cve.now/CVE-2026-57228.md): Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder (CVSS 8.2, OISF suricata)
- [CVE-2026-57224](https://cve.now/CVE-2026-57224.md): Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion (CVSS 6.5, OISF suricata)
- [CVE-2026-57226](https://cve.now/CVE-2026-57226.md): Suricata swf: heap buffer overflow in SWF decompression depth handling (CVSS 3.7, OISF suricata)
- [CVE-2026-57222](https://cve.now/CVE-2026-57222.md): Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6 (CVSS 5.3, OISF suricata)
- [CVE-2026-61720](https://cve.now/CVE-2026-61720.md): FluidSynth: SF2 DMOD Chunk Unsigned Underflow (CVSS 6.2, fluidsynth)
- [CVE-2026-61723](https://cve.now/CVE-2026-61723.md): FluidSynth: DLS ptbl Chunk Integer Overflow (CVSS 6.8, fluidsynth)
- [CVE-2026-61722](https://cve.now/CVE-2026-61722.md): FluidSynth: DLS Articulation Chunk Integer Overflow (CVSS 6.8, fluidsynth)
- [CVE-2026-61714](https://cve.now/CVE-2026-61714.md): FluidSynth: Heap Buffer Overflow in MIDI Player (CVSS 7.8, fluidsynth)
- [CVE-2026-61721](https://cve.now/CVE-2026-61721.md): FluidSynth: Heap-based buffer overrun for DLS samples (CVSS 8.0, fluidsynth)
- [CVE-2026-58264](https://cve.now/CVE-2026-58264.md): FluidSynth: Heap-based buffer overrun (CVSS 9.8, fluidsynth)
- [CVE-2026-76899](https://cve.now/CVE-2026-76899.md): CordysCRM: Authenticated SQL injection via \`sort.name\` on \`POST /account-pool/page\` (CVSS 5.7, 1Panel-dev CordysCRM)
- [CVE-2026-76902](https://cve.now/CVE-2026-76902.md): CordysCRM: Unauthenticated arbitrary file disclosure via \`/attachment/preview/{id}\` and \`/pic/preview/{id}\` (CVSS 5.0, 1Panel-dev CordysCRM)
- [CVE-2026-76900](https://cve.now/CVE-2026-76900.md): CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime (CVSS 6.8, 1Panel-dev CordysCRM)
- [CVE-2026-93873](https://cve.now/CVE-2026-93873.md): Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin (CVSS 5.3, Cotonti)
- [CVE-2026-93872](https://cve.now/CVE-2026-93872.md): Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter (CVSS 7.7, Cotonti)
- [CVE-2026-93871](https://cve.now/CVE-2026-93871.md): Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix (CVSS 5.1, Cotonti)
- [CVE-2026-93870](https://cve.now/CVE-2026-93870.md): Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler (CVSS 5.3, Cotonti)
- [CVE-2026-93869](https://cve.now/CVE-2026-93869.md): Cotonti through 1.0.0 Open Redirect via Unanchored cot\_url\_check() Regex (CVSS 5.3, Cotonti)
- [CVE-2026-93868](https://cve.now/CVE-2026-93868.md): Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG (CVSS 9.2, Cotonti)
- [CVE-2026-76901](https://cve.now/CVE-2026-76901.md): CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts (CVSS 5.8, 1Panel-dev CordysCRM)
- [CVE-2026-84239](https://cve.now/CVE-2026-84239.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.6, IBM Guardium Data Protection)
- [CVE-2026-92708](https://cve.now/CVE-2026-92708.md): devalue: Cross-request process memory disclosure in devalue when \`stringify\` / \`uneval\` serialize Node Buffers (CVSS 7.5, sveltejs devalue · devalue)
- [CVE-2026-63647](https://cve.now/CVE-2026-63647.md): CordysCRM SSE Notification Stream Hijack via \`/sse/subscribe\` (CVSS 9.3, 1Panel-dev CordysCRM)
- [CVE-2026-84241](https://cve.now/CVE-2026-84241.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.1, IBM Guardium Data Protection)
- [CVE-2026-84108](https://cve.now/CVE-2026-84108.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.1, IBM Guardium Data Protection)
- [CVE-2026-84106](https://cve.now/CVE-2026-84106.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.9, IBM Guardium Data Protection)
- [CVE-2026-84105](https://cve.now/CVE-2026-84105.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.7, IBM Guardium Data Protection)
- [CVE-2026-63646](https://cve.now/CVE-2026-63646.md): CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users (CVSS 6.9, 1Panel-dev CordysCRM)
- [CVE-2026-84089](https://cve.now/CVE-2026-84089.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.8, IBM Guardium Data Protection)
- [CVE-2026-84086](https://cve.now/CVE-2026-84086.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.2, IBM Guardium Data Protection)
- [CVE-2026-52745](https://cve.now/CVE-2026-52745.md): CordysCRM: Customer Public Pool Sorting Field SQL Injection (CVSS 5.3, 1Panel-dev CordysCRM)
- [CVE-2026-84085](https://cve.now/CVE-2026-84085.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.1, IBM Guardium Data Protection)
- [CVE-2026-84084](https://cve.now/CVE-2026-84084.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.8, IBM Guardium Data Protection)
- [CVE-2026-84083](https://cve.now/CVE-2026-84083.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.8, IBM Guardium Data Protection)
- [CVE-2026-84082](https://cve.now/CVE-2026-84082.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.8, IBM Guardium Data Protection)
- [CVE-2026-61819](https://cve.now/CVE-2026-61819.md): pg\_partman privilege escalation via SQL injection in when using pg\_jobmon and encountering exception (CVSS 8.5, pgpartman pg\_partman)
- [CVE-2026-61820](https://cve.now/CVE-2026-61820.md): pg\_partman privilege escalation via SQL injection when inheriting template properties (CVSS 8.5, pgpartman pg\_partman)
- [CVE-2026-84081](https://cve.now/CVE-2026-84081.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.1, IBM Guardium Data Protection)
- [CVE-2026-84078](https://cve.now/CVE-2026-84078.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.9, IBM Guardium Data Protection)
- [CVE-2026-61817](https://cve.now/CVE-2026-61817.md): pg\_partman privilege escalation via SQL injection in several functions via time decoder (CVSS 8.5, pgpartman pg\_partman)
- [CVE-2026-84077](https://cve.now/CVE-2026-84077.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.1, IBM Guardium Data Protection)
- [CVE-2026-84076](https://cve.now/CVE-2026-84076.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.6, IBM Guardium Data Protection)
- [CVE-2026-61818](https://cve.now/CVE-2026-61818.md): pg\_partman SQL injection in undo partition time encoder (CVSS 8.5, pgpartman pg\_partman)
- [CVE-2026-84075](https://cve.now/CVE-2026-84075.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.9, IBM Guardium Data Protection)
- [CVE-2026-61821](https://cve.now/CVE-2026-61821.md): pg\_partman authorization bypass to move child tables between schemas during retention (CVSS 8.5, pgpartman pg\_partman)
- [CVE-2026-84074](https://cve.now/CVE-2026-84074.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.9, IBM Guardium Data Protection)
- [CVE-2026-84073](https://cve.now/CVE-2026-84073.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.1, IBM Guardium Data Protection)
- [CVE-2026-61822](https://cve.now/CVE-2026-61822.md): pg\_partman disable maintenance for all partition sets (CVSS 6.5, pgpartman pg\_partman)
- [CVE-2026-84071](https://cve.now/CVE-2026-84071.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.2, IBM Guardium Data Protection)
- [CVE-2026-84070](https://cve.now/CVE-2026-84070.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.9, IBM Guardium Data Protection)
- [CVE-2026-84036](https://cve.now/CVE-2026-84036.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.4, IBM Guardium Data Protection)
- [CVE-2026-61781](https://cve.now/CVE-2026-61781.md): pg\_partman has privilege escalation through SQL injection in create\_partition\_time() (CVSS 9.9, pgpartman pg\_partman)
- [CVE-2026-84064](https://cve.now/CVE-2026-84064.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.9, IBM Guardium Data Protection)
- [CVE-2026-84034](https://cve.now/CVE-2026-84034.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.8, IBM Guardium Data Protection)
- [CVE-2026-77528](https://cve.now/CVE-2026-77528.md): Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation (CVSS 5.3, crossbario autobahn-python · crossbar +1)
- [CVE-2026-93031](https://cve.now/CVE-2026-93031.md): WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box \<= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import (CVSS 8.8, WP Cloud Plugins/\_deleeuw\_ Use-your-Drive | Google Drive… +2)
- [CVE-2026-84031](https://cve.now/CVE-2026-84031.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.0, IBM Guardium Data Protection)
- [CVE-2026-82967](https://cve.now/CVE-2026-82967.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.8, IBM Guardium Data Protection)
- [CVE-2026-82896](https://cve.now/CVE-2026-82896.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.6, IBM Guardium Data Protection)
- [CVE-2026-82893](https://cve.now/CVE-2026-82893.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.8, IBM Guardium Data Protection)
- [CVE-2026-82892](https://cve.now/CVE-2026-82892.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.1, IBM Guardium Data Protection)
- [CVE-2026-82890](https://cve.now/CVE-2026-82890.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 5.9, IBM Guardium Data Protection)
- [CVE-2026-82887](https://cve.now/CVE-2026-82887.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.8, IBM Guardium Data Protection)
- [CVE-2026-82885](https://cve.now/CVE-2026-82885.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.8, IBM Guardium Data Protection)
- [CVE-2026-82832](https://cve.now/CVE-2026-82832.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.6, IBM Guardium Data Protection)
- [CVE-2026-82340](https://cve.now/CVE-2026-82340.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.8, IBM Guardium Data Protection)
- [CVE-2026-81937](https://cve.now/CVE-2026-81937.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.2, IBM Guardium Data Protection)
- [CVE-2026-81933](https://cve.now/CVE-2026-81933.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.8, IBM Guardium Data Protection)
- [CVE-2026-81669](https://cve.now/CVE-2026-81669.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.2, IBM Guardium Data Protection)
- [CVE-2026-81657](https://cve.now/CVE-2026-81657.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.8, IBM Guardium Data Protection)
- [CVE-2026-81656](https://cve.now/CVE-2026-81656.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.8, IBM Guardium Data Protection)
- [CVE-2026-81626](https://cve.now/CVE-2026-81626.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.6, IBM Guardium Data Protection)
- [CVE-2026-81623](https://cve.now/CVE-2026-81623.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 6.3, IBM Guardium Data Protection)
- [CVE-2026-80442](https://cve.now/CVE-2026-80442.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.9, IBM Guardium Data Protection)
- [CVE-2026-80441](https://cve.now/CVE-2026-80441.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.8, IBM Guardium Data Protection)
- [CVE-2026-75878](https://cve.now/CVE-2026-75878.md): IBM Sterling File Gateway is Vulnerable to Authentication Bypass (CVSS 9.1, IBM Sterling File Gateway)
- [CVE-2026-18869](https://cve.now/CVE-2026-18869.md): IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP \[, \] (CVSS 6.4, IBM i)
- [CVE-2026-91202](https://cve.now/CVE-2026-91202.md): Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-17619](https://cve.now/CVE-2026-17619.md): The IBM Platform RTM is affected by an SQL injection vulnerability (CVSS 8.6, spectrum-lsf : IBM Platform RTM)
- [CVE-2026-91203](https://cve.now/CVE-2026-91203.md): Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition (CVSS 6.0, Red Hat Enterprise Linux)
- [CVE-2026-17262](https://cve.now/CVE-2026-17262.md): IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP \[, \] (CVSS 5.4, IBM i)
- [CVE-2026-11727](https://cve.now/CVE-2026-11727.md): IBM MQ for HPE NonStop is vulnerable to a denial of service issue (CVSS 8.1, IBM MQ for HPE NonStop)
- [CVE-2026-11726](https://cve.now/CVE-2026-11726.md): IBM MQ for HPE NonStop is vulnerable to a denial of service issue (CVSS 8.1, IBM MQ for HPE NonStop)
- [CVE-2026-11725](https://cve.now/CVE-2026-11725.md): IBM MQ queue manager is vulnerable to privilege escalation (CVSS 8.8, IBM MQ)
- [CVE-2026-91205](https://cve.now/CVE-2026-91205.md): Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race (CVSS 6.0, Red Hat Enterprise Linux)
- [CVE-2026-11722](https://cve.now/CVE-2026-11722.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2026-11716](https://cve.now/CVE-2026-11716.md): IBM MQ for HPE NonStop is vulnerable to a denial of service attack (CVSS 7.5, IBM MQ for HPE NonStop)
- [CVE-2026-11711](https://cve.now/CVE-2026-11711.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-11710](https://cve.now/CVE-2026-11710.md): IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-11549](https://cve.now/CVE-2026-11549.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-93841](https://cve.now/CVE-2026-93841.md): vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs (CVSS 6.3, vllm-project vllm · vllm)
- [CVE-2026-93840](https://cve.now/CVE-2026-93840.md): vLLM before 0.29.0 Cross-Request Logits Corruption via allowed\_token\_ids (CVSS 6.3, vllm-project vllm · vllm)
- [CVE-2026-93839](https://cve.now/CVE-2026-93839.md): LightLLM through 1.2.0 Missing Authentication in PD Master /pd\_register WebSocket Endpoint (CVSS 9.3, ModelTC LightLLM)
- [CVE-2026-93838](https://cve.now/CVE-2026-93838.md): SGLang through 0.5.20 Unbounded Memory Allocation via STAGING\_REQ chunk\_idx (CVSS 8.2, sgl-project sglang)
- [CVE-2026-11548](https://cve.now/CVE-2026-11548.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2026-11545](https://cve.now/CVE-2026-11545.md): IBM WebSphere Application Server is affected by a privilege escalation (CVSS 3.7, IBM WebSphere Application Server)
- [CVE-2026-11540](https://cve.now/CVE-2026-11540.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2026-11539](https://cve.now/CVE-2026-11539.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2026-75895](https://cve.now/CVE-2026-75895.md): Out of bounds read at smpp34\_unpack() (CVSS 7.5, Osmocom libsmpp34)
- [CVE-2017-20284](https://cve.now/CVE-2017-20284.md): Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet (CVSS 8.7, Caucho Technology Resin)
- [CVE-2026-11538](https://cve.now/CVE-2026-11538.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 3.7, IBM WebSphere Application Server)
- [CVE-2021-48008](https://cve.now/CVE-2021-48008.md): Chanjet CRM SQL Injection via get\_usedspace.php (CVSS 8.7, Chanjet Information Technology Co. CRM)
- [CVE-2019-25776](https://cve.now/CVE-2019-25776.md): Weaver E-cology SQL Injection via SyncUserInfo.jsp (CVSS 8.7, Weaver Network Co. E-cology)
- [CVE-2023-54399](https://cve.now/CVE-2023-54399.md): Hongjing e-HR \< 8.2 SQL Injection via /servlet/codesettree (CVSS 9.3, Hongjing e-HR)
- [CVE-2026-93854](https://cve.now/CVE-2026-93854.md): In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2 (CVSS 7.2, OpenStack Blazar)
- [CVE-2026-75894](https://cve.now/CVE-2026-75894.md): Reachable assertion at ranap\_handle\_co\_dt() (CVSS 7.5, Osmocom osmo-iuh)
- [CVE-2026-93852](https://cve.now/CVE-2026-93852.md): In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing projec (CVSS 7.1, OpenStack Blazar)
- [CVE-2026-75893](https://cve.now/CVE-2026-75893.md): Heap based buffer overflow at ipaccess\_proxy\_read\_msg() (CVSS 7.5, Osmocom osmo-bsc)
- [CVE-2026-75892](https://cve.now/CVE-2026-75892.md): Out of bounds write in PDP ctx GSN-Address decode (CVSS 6.5, Osmocom osmo-ggsn)
- [CVE-2026-93650](https://cve.now/CVE-2026-93650.md): Saleor throttling.py get\_client\_ip excessive authentication (CVSS 6.3, Saleor)
- [CVE-2026-59163](https://cve.now/CVE-2026-59163.md): Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass (CVSS 9.1, AxDSan mnemosyne · mnemosyne-memory)
- [CVE-2026-92768](https://cve.now/CVE-2026-92768.md): Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-92747](https://cve.now/CVE-2026-92747.md): Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list (CVSS 5.0, Red Hat Enterprise Linux)
- [CVE-2026-92745](https://cve.now/CVE-2026-92745.md): Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments (CVSS 5.0, Red Hat Enterprise Linux)
- [CVE-2026-93432](https://cve.now/CVE-2026-93432.md): Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus (CVSS 6.1, Red Hat build of Quarkus 3.27.6.redhat · Red Hat build o… +6)
- [CVE-2026-93753](https://cve.now/CVE-2026-93753.md): deepmerge through 4.3.1 Prototype Poisoning via mergeObject (CVSS 8.7, TehShrike deepmerge · deepmerge)
- [CVE-2026-93752](https://cve.now/CVE-2026-93752.md): CSSOM through 0.5.0 Denial of Service via length Property (CVSS 8.7, NV CSSOM)
- [CVE-2026-93751](https://cve.now/CVE-2026-93751.md): uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars (CVSS 6.9, garycourt uri-js)
- [CVE-2026-93750](https://cve.now/CVE-2026-93750.md): http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard (CVSS 8.2, kornelski http-cache-semantics)
- [CVE-2026-93749](https://cve.now/CVE-2026-93749.md): source-map-js through 1.2.1 Event Loop Denial of Service (CVSS 8.7, 7rulnik source-map-js · source-map-js)
- [CVE-2026-93748](https://cve.now/CVE-2026-93748.md): http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale (CVSS 8.7, kornelski http-cache-semantics · http-cache-semantics)
- [CVE-2026-81181](https://cve.now/CVE-2026-81181.md): SysReptor: Session Fixation in Password-Protected Shared Notes (CVSS 3.7, Syslifters sysreptor)
- [CVE-2026-81182](https://cve.now/CVE-2026-81182.md): SysReptor: Unauthorized file disclosure by broken access control in writable shared notes (CVSS 4.2, Syslifters sysreptor)
- [CVE-2026-81180](https://cve.now/CVE-2026-81180.md): SysReptor: Authenticated RCE by insecure image processing (CVSS 8.8, Syslifters sysreptor)
- [CVE-2026-81179](https://cve.now/CVE-2026-81179.md): SysReptor: Host header injection might allow account takeover (CVSS 8.1, Syslifters sysreptor)
- [CVE-2026-81178](https://cve.now/CVE-2026-81178.md): SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity (CVSS 3.5, Syslifters sysreptor)
- [CVE-2026-71537](https://cve.now/CVE-2026-71537.md): Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade) (CVSS 6.5, Paymenter · paymenter/paymenter)
- [CVE-2026-85058](https://cve.now/CVE-2026-85058.md): Moquette: Missing Authorization in io.moquette:moquette-broker (CVSS 7.5, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-63445](https://cve.now/CVE-2026-63445.md): Perses: Unvalidated project parameter enables filesystem path traversal (CVSS 7.1, perses · github.com/perses/perses)
- [CVE-2026-63199](https://cve.now/CVE-2026-63199.md): Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure (CVSS 8.3, perses · github.com/perses/perses)
- [CVE-2026-63458](https://cve.now/CVE-2026-63458.md): Perses project query parameter authorization bypass exposes cross-project resources (CVSS 7.1, perses · github.com/perses/perses)
- [CVE-2026-32641](https://cve.now/CVE-2026-32641.md): Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware (CVSS 7.5, parseablehq parseable)
- [CVE-2026-93759](https://cve.now/CVE-2026-93759.md): Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist (CVSS 8.8, MongoDB Mongoid)
- [CVE-2026-69184](https://cve.now/CVE-2026-69184.md): c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVSS 7.5, c-ares)
- [CVE-2026-69186](https://cve.now/CVE-2026-69186.md): c-ares: Memory-amplification denial of service via unvalidated DNS header record counts (CVSS 5.3, c-ares)
- [CVE-2026-61552](https://cve.now/CVE-2026-61552.md): Icinga 2 DSL Injection via Unescaped Import Template Name (CVSS 7.2, icinga2)
- [CVE-2026-93760](https://cve.now/CVE-2026-93760.md): NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard (CVSS 8.3, MongoDB Mongoid)
- [CVE-2026-61551](https://cve.now/CVE-2026-61551.md): Icinga 2: Stack overflow via deeply nested JSON objects (CVSS 8.6, icinga2)
- [CVE-2026-61550](https://cve.now/CVE-2026-61550.md): Icinga 2: Improper access control for JSON-RPC update certificate messages (CVSS 9.8, icinga2)
- [CVE-2026-93761](https://cve.now/CVE-2026-93761.md): Denial of service via unbounded regex matching in Mongoid's in-memory query matcher (CVSS 8.7, MongoDB Mongoid)
- [CVE-2026-91127](https://cve.now/CVE-2026-91127.md): File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer (CVSS 8.2, flyfish-dev file-viewer · @file-viewer doc +3)
- [CVE-2026-77386](https://cve.now/CVE-2026-77386.md): Kyoo: OIDC login token can be redirected to an attacker-controlled URL (CVSS 6.5, zoriya Kyoo)
- [CVE-2026-77385](https://cve.now/CVE-2026-77385.md): Kyoo: Transcoder serves uncataloged files from the media directory (CVSS 4.3, zoriya Kyoo)
- [CVE-2026-93762](https://cve.now/CVE-2026-93762.md): Data deletion and attribute disclosure via field-name method injection in in-memory queries (CVSS 9.2, MongoDB Mongoid)
- [CVE-2026-33625](https://cve.now/CVE-2026-33625.md): LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant\_dtype in model config loading (CVSS 8.8, InternLM lmdeploy · lmdeploy)
- [CVE-2026-62278](https://cve.now/CVE-2026-62278.md): LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory (CVSS 8.1, hargata lubelog)
- [CVE-2026-62279](https://cve.now/CVE-2026-62279.md): LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check (CVSS 7.1, hargata lubelog)
- [CVE-2026-93763](https://cve.now/CVE-2026-93763.md): Silent plaintext persistence via unresolved callable database name in encryption schema map (CVSS 7.1, MongoDB Mongoid)
- [CVE-2026-84992](https://cve.now/CVE-2026-84992.md): md-editor-v3: XSS via fenced-code language rendering bypass (CVSS 6.1, imzbf md-editor-v3 · md-editor-v3)
- [CVE-2026-84975](https://cve.now/CVE-2026-84975.md): PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends) (CVSS 7.4, pjsip pjproject)
- [CVE-2026-77396](https://cve.now/CVE-2026-77396.md): PJSIP: Heap buffer overflow in the AVI parser (CVSS 6.9, pjsip pjproject)
- [CVE-2026-93764](https://cve.now/CVE-2026-93764.md): Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation (CVSS 7.1, MongoDB Mongoid)
- [CVE-2026-92701](https://cve.now/CVE-2026-92701.md): Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path (CVSS 9.1, ultravioletrs cocos)
- [CVE-2026-64847](https://cve.now/CVE-2026-64847.md): AnyIO process-pool workers can block indefinitely on undrained stderr (CVSS 6.8, agronholm anyio · anyio)
- [CVE-2025-66455](https://cve.now/CVE-2025-66455.md): LMDeploy has Remote Code Execution by Pickle Deserialization via handle\_zmq\_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine\_conn.py (CVSS 9.8, InternLM lmdeploy · lmdeploy)
- [CVE-2026-92702](https://cve.now/CVE-2026-92702.md): Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path (CVSS 9.1, ultravioletrs cocos)
- [CVE-2026-63349](https://cve.now/CVE-2026-63349.md): AnyIO run\_process/open\_process ignores extra\_groups and can retain parent supplementary groups (CVSS 7.0, agronholm anyio · anyio)
- [CVE-2026-93765](https://cve.now/CVE-2026-93765.md): Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation (CVSS 8.3, MongoDB Mongoid)
- [GHSA-JR78-W6W5-M8F8](https://cve.now/GHSA-JR78-W6W5-M8F8.md): Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks (high (no CVSS), mediawiki/semantic-media-wiki)
- [CVE-2026-77616](https://cve.now/CVE-2026-77616.md): Semantic MediaWiki affected by reflected XSS in \`Special:Ask\` via a forged cursor pagination token (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-93758](https://cve.now/CVE-2026-93758.md): Cross-principal document update, theft, and deletion via unvalidated id in nested attributes (CVSS 8.6, MongoDB Mongoid)
- [CVE-2026-61833](https://cve.now/CVE-2026-61833.md): zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion (CVSS 8.1, project-zot zot · zotregistry.dev/zot/v2 +1)
- [CVE-2026-77610](https://cve.now/CVE-2026-77610.md): Semantic MediaWiki has a query debug output XSS (\`DebugFormatter\`) (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-61548](https://cve.now/CVE-2026-61548.md): Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data (CVSS 8.1, rsyslog)
- [CVE-2026-55556](https://cve.now/CVE-2026-55556.md): Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling (CVSS 8.2, rsyslog)
- [CVE-2026-77609](https://cve.now/CVE-2026-77609.md): Semantic MediaWiki has an open redirect in Special:URIResolver (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-63406](https://cve.now/CVE-2026-63406.md): AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets (CVSS 5.9, anycable · github.com/anycable/anycable +1)
- [CVE-2026-77607](https://cve.now/CVE-2026-77607.md): Semantic MediaWiki affected by Special:Ask table \`sep\` parameter reflected XSS (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-63405](https://cve.now/CVE-2026-63405.md): AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body (CVSS 5.9, anycable · github.com/anycable/anycable-go +1)
- [CVE-2026-46655](https://cve.now/CVE-2026-46655.md): virtio-win: Integer overflow causing a heap overflow in Viosock driver (CVSS 7.8, virtio-win kvm-guest-drivers-windows)
- [CVE-2026-77239](https://cve.now/CVE-2026-77239.md): WACRM: Service-role routes missing a role check (CVSS 8.1, ArnasDon wacrm)
- [CVE-2026-93559](https://cve.now/CVE-2026-93559.md): Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication (CVSS 6.9, Forget-C Jellyfish AI Short Drama Studio)
- [CVE-2026-91142](https://cve.now/CVE-2026-91142.md): Cockpit: cockpit: unauthorized modification of login records via integer overflow (CVSS 3.6, Red Hat Enterprise Linux · Red Hat OpenShift Dev Spaces)
- [CVE-2026-91147](https://cve.now/CVE-2026-91147.md): Cockpit: cockpit: denial of service in \`cockpit-ws\` due to url-root handling without a trailing slash (CVSS 5.9, Red Hat Enterprise Linux · Red Hat OpenShift Dev Spaces)
- [CVE-2026-91149](https://cve.now/CVE-2026-91149.md): Cockpit: cockpit: denial of service via unbounded connection thread spawning (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Dev Spaces)
- [CVE-2026-77608](https://cve.now/CVE-2026-77608.md): Semantic MediaWiki has reflected XSS in \`Special:SearchByProperty\` (\`property\` and \`value\` parameters) (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-77240](https://cve.now/CVE-2026-77240.md): WACRM: Database-layer authorization bypasses (CVSS 9.9, ArnasDon wacrm)
- [CVE-2026-77606](https://cve.now/CVE-2026-77606.md): Semantic MediaWiki has reflected XSS in Special:Ask plain table headers (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-77301](https://cve.now/CVE-2026-77301.md): adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) (CVSS 7.5, cthackers adm-zip · adm-zip)
- [CVE-2026-93579](https://cve.now/CVE-2026-93579.md): Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough) (CVSS 6.5, Red Hat Build of Debezium · Red Hat build of Quarkus 3.… +10)
- [CVE-2026-77339](https://cve.now/CVE-2026-77339.md): Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools (CVSS 5.1, F1bonacc1 process-compose · github.com/f1bonacc1/process-co…)
- [CVE-2026-58197](https://cve.now/CVE-2026-58197.md): ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement (CVSS 8.8, stacklok toolhive · stacklok toolhive-studio +1)
- [CVE-2026-61795](https://cve.now/CVE-2026-61795.md): Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation (CVSS 6.8, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-93534](https://cve.now/CVE-2026-93534.md): spatie Scotty Self Update SelfUpdater.php update code download (CVSS 5.3, spatie Scotty)
- [CVE-2026-61672](https://cve.now/CVE-2026-61672.md): Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement (CVSS 7.1, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-61794](https://cve.now/CVE-2026-61794.md): Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic (CVSS 6.8, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-62943](https://cve.now/CVE-2026-62943.md): btrbk: SSH Command Filter Bypass in ssh\_filter\_btrbk.sh (CVSS 8.7, digint btrbk)
- [CVE-2026-81321](https://cve.now/CVE-2026-81321.md): CareCam CM2507 Cleartext Storage of Sensitive Information (CVSS 9.8, CareCam HMT.CM2507 Firmware)
- [CVE-2026-93338](https://cve.now/CVE-2026-93338.md): Grandstream GWN7660ELR \< 1.0.27.6 Information Disclosure via SNMP Default Community String (CVSS 6.9, Grandstream Networks GWN7660ELR)
- [CVE-2026-81505](https://cve.now/CVE-2026-81505.md): Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials (CVSS 7.1, frain-dev convoy · github.com/frain-dev/convoy)
- [CVE-2026-73863](https://cve.now/CVE-2026-73863.md): NanoMQ: Heap-Buffer-Overflow in \`nmq\_subinfo\_decode()\` During MQTT v5 SUBSCRIBE Parsing (CVSS 7.0, nanomq)
- [CVE-2026-85497](https://cve.now/CVE-2026-85497.md): CareCam CM2507 Use of Password Hash With Insufficient Computational Effort (CVSS 9.8, CareCam HMT.CM2507 Firmware)
- [CVE-2026-61633](https://cve.now/CVE-2026-61633.md): NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS (CVSS 2.0, nanomq)
- [CVE-2026-44639](https://cve.now/CVE-2026-44639.md): NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing (CVSS 3.7, nanomq)
- [CVE-2026-85478](https://cve.now/CVE-2026-85478.md): CareCam CM2507 Missing Authentication for Critical Function (CVSS 3.5, CareCam HMT.CM2507 Firmware)
- [CVE-2026-93533](https://cve.now/CVE-2026-93533.md): spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection (CVSS 5.3, spatie Scotty)
- [CVE-2026-81305](https://cve.now/CVE-2026-81305.md): CareCam CM2507 Inclusion of Functionality from Untrusted Control Sphere (CVSS 6.8, CareCam HMT.CM2507 Firmware)
- [CVE-2026-61682](https://cve.now/CVE-2026-61682.md): kcp front-proxy does not strip inbound X-Remote-\* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace (CVSS 9.9, kcp-dev kcp · github.com/kcp-dev/kcp)
- [CVE-2026-54147](https://cve.now/CVE-2026-54147.md): http4k: \`DigestAuthProvider.verify\` ignored configured algorithm and did not bind to request URI (CVSS 6.5, http4k · org.http4k:http4k-security-digest)
- [CVE-2026-11537](https://cve.now/CVE-2026-11537.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2026-84400](https://cve.now/CVE-2026-84400.md): CareCam CM2507 Missing Authentication for Critical Function (CVSS 3.1, CareCam HMT.CM2507 Firmware)
- [CVE-2026-54148](https://cve.now/CVE-2026-54148.md): http4k: \`DigestAuthProvider.verify\` did not bind to request URI (CVSS 8.1, http4k · org.http4k:http4k-security-digest)
- [CVE-2026-11381](https://cve.now/CVE-2026-11381.md): IBM MQ for HPE NonStop is vulnerable to a denial of service issue (CVSS 8.8, IBM MQ for HPE NonStop)
- [CVE-2026-11378](https://cve.now/CVE-2026-11378.md): IBM MQ queue manager is vulnerable to remote code execution (CVSS 8.8, IBM MQ)
- [CVE-2025-61682](https://cve.now/CVE-2025-61682.md): Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes (CVSS 8.6, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-11375](https://cve.now/CVE-2026-11375.md): IBM MQ queue manager is vulnerable to remote code execution (CVSS 8.8, IBM MQ)
- [CVE-2026-10858](https://cve.now/CVE-2026-10858.md): IBM MQ for HPE NonStop is vulnerable to a denial of service attack (CVSS 9.9, IBM MQ for HPE NonStop)
- [CVE-2026-84398](https://cve.now/CVE-2026-84398.md): CareCam CM2507 Empty Password in Configuration File (CVSS 7.5, CareCam HMT.CM2507 Firmware)
- [CVE-2026-10853](https://cve.now/CVE-2026-10853.md): IBM MQ queue manager is vulnerable to remote code execution (CVSS 7.5, IBM MQ)
- [CVE-2026-10841](https://cve.now/CVE-2026-10841.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2026-88259](https://cve.now/CVE-2026-88259.md): CareCam CM2507 Missing Authentication for Critical Function (CVSS 7.5, CareCam HMT.CM2507 Firmware)
- [CVE-2026-84450](https://cve.now/CVE-2026-84450.md): libheif: \`clap\` + oversized \`ispe\` aborts on an assert in \`Fraction::Fraction\` (incomplete fix for CVE-2026-62289) (CVSS 4.3, strukturag libheif)
- [CVE-2026-93737](https://cve.now/CVE-2026-93737.md): Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet (CVSS 7.1, azkaban)
- [CVE-2026-93736](https://cve.now/CVE-2026-93736.md): Mealie before 3.21.0 Information Disclosure via Ratings Endpoint (CVSS 5.3, mealie-recipes mealie)
- [CVE-2026-84449](https://cve.now/CVE-2026-84449.md): libheif hOp\_RGB24\_32\_to\_YCbCr Memory Access Error / SEGV (CVSS 3.7, strukturag libheif)
- [CVE-2026-84451](https://cve.now/CVE-2026-84451.md): libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read (CVSS 6.5, strukturag libheif)
- [CVE-2026-84447](https://cve.now/CVE-2026-84447.md): libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS (CVSS 7.5, strukturag libheif)
- [CVE-2026-84384](https://cve.now/CVE-2026-84384.md): libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (CVSS 7.5, strukturag libheif)
- [CVE-2026-10751](https://cve.now/CVE-2026-10751.md): IBM MQ Java messaging is vulnerable to remote code execution (CVSS 7.5, IBM MQ)
- [CVE-2026-84444](https://cve.now/CVE-2026-84444.md): libheif uncompressed tiled image encoding allows out-of-bounds write (CVSS 7.4, strukturag libheif)
- [CVE-2026-84383](https://cve.now/CVE-2026-84383.md): libheif: Heap buffer overflow in \`scale\_nearest\_neighbor()\` via duplicate Alpha planes from nested \`iden\`/\`auxl\` items (CVSS 9.8, strukturag libheif)
- [CVE-2026-10747](https://cve.now/CVE-2026-10747.md): IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing (CVSS 10.0, IBM MQ Appliance)
- [CVE-2026-84446](https://cve.now/CVE-2026-84446.md): libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max\_sequence\_frames (CVSS 7.5, strukturag libheif)
- [CVE-2026-10744](https://cve.now/CVE-2026-10744.md): IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validation (CVSS 7.5, IBM MQ for HPE NonStop)
- [CVE-2026-84448](https://cve.now/CVE-2026-84448.md): libheif: Heap out-of-bounds read in libheif inline-mask region API (heif\_region\_item\_add\_region\_inline\_mask\_data / heif\_region\_get\_mask\_image) (CVSS 4.0, strukturag libheif)
- [CVE-2026-10575](https://cve.now/CVE-2026-10575.md): IBM MQ queue manager is vulnerable to remote code execution (CVSS 8.8, IBM MQ)
- [CVE-2026-1037](https://cve.now/CVE-2026-1037.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 6.1, IBM Common Licensing)
- [CVE-2026-1031](https://cve.now/CVE-2026-1031.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 6.1, IBM Common Licensing)
- [CVE-2026-77960](https://cve.now/CVE-2026-77960.md): Use of Hard-coded Credentials in Bransys ELD (CVSS 5.3, Bransys ELD)
- [CVE-2026-1030](https://cve.now/CVE-2026-1030.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 4.3, IBM Common Licensing)
- [CVE-2026-65969](https://cve.now/CVE-2026-65969.md): OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV (CVSS 5.5, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-1029](https://cve.now/CVE-2026-1029.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 5.4, IBM Common Licensing)
- [CVE-2026-1025](https://cve.now/CVE-2026-1025.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 6.1, IBM Common Licensing)
- [CVE-2026-67549](https://cve.now/CVE-2026-67549.md): OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write (CVSS 7.6, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-86689](https://cve.now/CVE-2026-86689.md): Cleartext Transmission of Sensitive Information in Bransys ELD (CVSS 5.9, Bransys ELD)
- [CVE-2026-63638](https://cve.now/CVE-2026-63638.md): OpenImageIO: Cineon invalid bit depth heap out-of-bounds write (CVSS 8.3, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-10030](https://cve.now/CVE-2026-10030.md): IBM MQ Console is vulnerable to privilege escalation (CVSS 7.1, IBM MQ)
- [CVE-2026-63419](https://cve.now/CVE-2026-63419.md): OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer (CVSS 7.8, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-10027](https://cve.now/CVE-2026-10027.md): IBM MQ queue manager is vulnerable to unauthenticated remote code execution (CVSS 8.1, IBM MQ)
- [CVE-2026-93532](https://cve.now/CVE-2026-93532.md): gedelumbung HospitalManagement Password Change password.php simpan improper authentication (CVSS 5.3, gedelumbung HospitalManagement)
- [CVE-2025-36421](https://cve.now/CVE-2025-36421.md): Multiple vulnerabilities in IBM Controller (CVSS 5.9, IBM Controller)
- [CVE-2026-86520](https://cve.now/CVE-2026-86520.md): Use of Hard-coded Credentials in Bransys ELD (CVSS 7.5, Bransys ELD)
- [CVE-2025-36178](https://cve.now/CVE-2025-36178.md): Multiple vulnerabilities in IBM Controller (CVSS 5.4, IBM Controller)
- [CVE-2025-36147](https://cve.now/CVE-2025-36147.md): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting. (CVSS 6.1, IBM Financial Transaction Manager for SWIFT Services for Mu…)
- [CVE-2026-65970](https://cve.now/CVE-2026-65970.md): OpenImageIO: TIFF multithreaded scanline read use-after-scope in \`TIFFInput::read\_native\_scanlines\` (CVSS 5.3, AcademySoftwareFoundation OpenImageIO)
- [CVE-2025-36076](https://cve.now/CVE-2025-36076.md): IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2025-36045](https://cve.now/CVE-2025-36045.md): TS4300 Tape Library addresses security vulnerability (CVSS 4.3, IBM TS4300)
- [CVE-2025-33147](https://cve.now/CVE-2025-33147.md): IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities (CVSS 5.9, IBM Cognos Analytics)
- [CVE-2025-33141](https://cve.now/CVE-2025-33141.md): IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment. (CVSS 6.5, IBM QRadar)
- [CVE-2026-63635](https://cve.now/CVE-2026-63635.md): OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS (CVSS 5.5, AcademySoftwareFoundation OpenImageIO)
- [CVE-2025-15399](https://cve.now/CVE-2025-15399.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 10.0, IBM Common Licensing)
- [CVE-2026-63422](https://cve.now/CVE-2026-63422.md): OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write (CVSS 7.8, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-63420](https://cve.now/CVE-2026-63420.md): OpenImageIO: PSD RawColor indexed image out-of-bounds read in \`interleave\_row\` (CVSS 5.5, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-59181](https://cve.now/CVE-2026-59181.md): OpenImageIO: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElements (CVSS 6.1, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-59156](https://cve.now/CVE-2026-59156.md): OpenImageIO: Unbounded recursion in FITS header parser leads to stack overflow (CVSS 6.5, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-59956](https://cve.now/CVE-2026-59956.md): OpenImageIO: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is set (CVSS 6.1, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-75883](https://cve.now/CVE-2026-75883.md): PPPD buffer overflow in PEAP response code (CVSS 6.8, PPP Project ppp)
- [CVE-2025-14754](https://cve.now/CVE-2025-14754.md): IBM Cloud Pak for Data is vulnerable to OS command injection (CVSS 8.8, IBM Cloud Pak for Data)
- [CVE-2026-75031](https://cve.now/CVE-2026-75031.md): In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin featur (CVSS 9.8, Interchange)
- [CVE-2025-14753](https://cve.now/CVE-2025-14753.md): IBM Cloud Pak for Data is vulnerable to path traversal (CVSS 7.5, IBM Cloud Pak for Data)
- [CVE-2026-81946](https://cve.now/CVE-2026-81946.md): PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm (CVSS 6.7, PLANET Technology PLANET IGS-5225-8P2T4S)
- [CVE-2026-81945](https://cve.now/CVE-2026-81945.md): PLANET IGS-5225-8P2T4S V1/V2 Admin Stack-Based Buffer Overflow via Web Server (CVSS 7.5, PLANET Technology PLANET IGS-5225-8P2T4S)
- [CVE-2026-81944](https://cve.now/CVE-2026-81944.md): PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web Server (CVSS 7.7, PLANET Technology PLANET IGS-5225-8P2T4S)
- [CVE-2026-81943](https://cve.now/CVE-2026-81943.md): PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE (CVSS 8.4, PLANET Technology PLANET IGS-5225-8P2T4S)
- [CVE-2026-93531](https://cve.now/CVE-2026-93531.md): gedelumbung HospitalManagement cross-site request forgery (CVSS 5.3, gedelumbung HospitalManagement)
- [CVE-2026-81942](https://cve.now/CVE-2026-81942.md): PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server (CVSS 8.7, PLANET Technology PLANET IGS-5225-8P2T4S)
- [CVE-2025-53837](https://cve.now/CVE-2025-53837.md): org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue (CVSS 9.9, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml)
- [CVE-2026-93690](https://cve.now/CVE-2026-93690.md): uri-js through 4.4.1 Denial of Service via removeDotSegments (CVSS 8.7, garycourt uri-js)
- [CVE-2026-93689](https://cve.now/CVE-2026-93689.md): WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I/O (CVSS 6.8, winfsp)
- [CVE-2026-93688](https://cve.now/CVE-2026-93688.md): SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap\_room (CVSS 8.7, sgl-project sglang)
- [CVE-2026-93687](https://cve.now/CVE-2026-93687.md): braces through 3.0.3 Stack Overflow via Deeply Nested Patterns (CVSS 8.7, micromatch braces · braces)
- [CVE-2026-7006](https://cve.now/CVE-2026-7006.md): Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism (CVSS 7.0, Sublime HQ Pty Sublime Text)
- [CVE-2026-93685](https://cve.now/CVE-2026-93685.md): Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering) (CVSS 5.4, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-93506](https://cve.now/CVE-2026-93506.md): SveltyCMS File Upload Endpoint upload-media server-side request forgery (CVSS 5.3, SveltyCMS)
- [CVE-2026-93573](https://cve.now/CVE-2026-93573.md): Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling (CVSS 6.5, Red Hat Build of Debezium · Red Hat build of Quarkus 3.… +11)
- [CVE-2026-93652](https://cve.now/CVE-2026-93652.md): Integer Overflow or Wraparound in µD3TN (CVSS 7.5, µD3TN)
- [CVE-2026-93568](https://cve.now/CVE-2026-93568.md): Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +11)
- [CVE-2025-13882](https://cve.now/CVE-2025-13882.md): Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager. (CVSS 5.3, IBM Sterling Partner Engagement Manager Essentials Edition…)
- [CVE-2026-93576](https://cve.now/CVE-2026-93576.md): Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419) (CVSS 7.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +2)
- [CVE-2025-1350](https://cve.now/CVE-2025-1350.md): Multiple vulnerabilities in IBM Controller (CVSS 5.3, IBM Controller)
- [CVE-2026-16515](https://cve.now/CVE-2026-16515.md): ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack (CVSS 4.7, zephyrproject zephyr)
- [CVE-2026-16514](https://cve.now/CVE-2026-16514.md): Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved (CVSS 4.3, zephyrproject zephyr)
- [CVE-2026-16512](https://cve.now/CVE-2026-16512.md): Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames (CVSS 3.1, zephyrproject zephyr)
- [CVE-2024-56344](https://cve.now/CVE-2024-56344.md): IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities (CVSS 5.9, IBM Cognos Analytics)
- [CVE-2026-85511](https://cve.now/CVE-2026-85511.md): Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2 (CVSS 4.2, Red Hat JBoss Enterprise Application Platform 8.1.8.GA ·… +4)
- [CVE-2026-93569](https://cve.now/CVE-2026-93569.md): Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority (CVSS 8.2, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +11)
- [CVE-2026-77929](https://cve.now/CVE-2026-77929.md): ClipBucket \< 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint (CVSS 8.7, MacWarrior clipbucket-v5)
- [CVE-2026-93567](https://cve.now/CVE-2026-93567.md): Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +11)
- [CVE-2026-93660](https://cve.now/CVE-2026-93660.md): SQLBot through 1.10.1 Improper Access Control via Dashboard Update (CVSS 7.1, dataease SQLBot)
- [CVE-2026-93659](https://cve.now/CVE-2026-93659.md): Concrete CMS Community Store before 2.7.8 Stored XSS (CVSS 8.6, concretecms-community-store community\_store)
- [CVE-2026-93658](https://cve.now/CVE-2026-93658.md): uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid (CVSS 7.3, uutils coreutils)
- [CVE-2026-93657](https://cve.now/CVE-2026-93657.md): hickory-resolver before 0.26.2 DNSSEC Validation Bypass (CVSS 8.7, hickory-dns hickory-resolver · hickory-resolver)
- [CVE-2026-77928](https://cve.now/CVE-2026-77928.md): ClipBucket \< 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint (CVSS 7.1, MacWarrior clipbucket-v5)
- [CVE-2026-93676](https://cve.now/CVE-2026-93676.md): Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks (CVSS 3.2, Red Hat Enterprise Linux)
- [CVE-2026-10832](https://cve.now/CVE-2026-10832.md): Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload (CVSS 5.9, Red Hat JBoss Enterprise Application Platform 8.1.8.GA… +12)
- [CVE-2026-93566](https://cve.now/CVE-2026-93566.md): Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line (CVSS 6.5, Red Hat Build of Debezium · Red Hat build of Quarkus 3.… +11)
- [CVE-2026-93565](https://cve.now/CVE-2026-93565.md): Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12)
- [CVE-2026-77927](https://cve.now/CVE-2026-77927.md): ClipBucket \< 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint (CVSS 7.1, MacWarrior clipbucket-v5)
- [CVE-2026-93505](https://cve.now/CVE-2026-93505.md): SveltyCMS SVG Media Upload media-service.server.ts cross site scripting (CVSS 5.1, SveltyCMS)
- [CVE-2026-93653](https://cve.now/CVE-2026-93653.md): Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-93564](https://cve.now/CVE-2026-93564.md): Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881) (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +10)
- [CVE-2026-93558](https://cve.now/CVE-2026-93558.md): Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12)
- [CVE-2026-25684](https://cve.now/CVE-2026-25684.md): File Type Control rule bypass (CVSS 4.4, Zscaler ZIA File Type Control)
- [CVE-2026-93019](https://cve.now/CVE-2026-93019.md): Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga\_palette\_read (CVSS 9.1, Imager)
- [CVE-2026-93018](https://cve.now/CVE-2026-93018.md): Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i\_gpix\_p and i\_glin\_p (CVSS 5.5, Imager)
- [CVE-2026-62282](https://cve.now/CVE-2026-62282.md): OpenCVE: Server-Side Request Forgery (SSRF) in notifications (CVSS 6.5, opencve)
- [CVE-2026-93560](https://cve.now/CVE-2026-93560.md): Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos (CVSS 7.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +2)
- [CVE-2026-93606](https://cve.now/CVE-2026-93606.md): vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species (CVSS 10.0, patriksimek vm2)
- [CVE-2026-93605](https://cve.now/CVE-2026-93605.md): vm2 NodeVM before 3.12.1 Remote Code Execution via child\_process (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-93604](https://cve.now/CVE-2026-93604.md): vm2 3.11.8 Sandbox Escape via crypto.setFips (CVSS 6.9, patriksimek vm2)
- [CVE-2026-93603](https://cve.now/CVE-2026-93603.md): vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function (CVSS 10.0, patriksimek vm2)
- [CVE-2026-93602](https://cve.now/CVE-2026-93602.md): rustls-webpki before 0.103.10 CRL Revocation Check Bypass (CVSS 5.9, rustls webpki · rustls-webpki)
- [CVE-2026-93601](https://cve.now/CVE-2026-93601.md): rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass (CVSS 2.1, rustls webpki · rustls-webpki)
- [CVE-2026-93600](https://cve.now/CVE-2026-93600.md): rustls webpki Name Constraints URI Validation Bypass (CVSS 2.1, rustls webpki · rustls-webpki)
- [CVE-2026-93599](https://cve.now/CVE-2026-93599.md): rustls-webpki before 0.103.13 Panic via empty BIT STRING (CVSS 8.7, rustls webpki · rustls-webpki)
- [CVE-2026-93598](https://cve.now/CVE-2026-93598.md): ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle (CVSS 7.1, ArcadeData arcadedb)
- [CVE-2026-93597](https://cve.now/CVE-2026-93597.md): ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses (CVSS 5.3, ArcadeData arcadedb)
- [CVE-2026-93596](https://cve.now/CVE-2026-93596.md): ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect (CVSS 5.3, ArcadeData arcadedb)
- [CVE-2026-93595](https://cve.now/CVE-2026-93595.md): ArcadeDB before 26.9.1 ACL Bypass via query\_database Tool (CVSS 7.1, ArcadeData arcadedb)
- [CVE-2026-93594](https://cve.now/CVE-2026-93594.md): ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries (CVSS 7.1, ArcadeData arcadedb)
- [CVE-2026-93593](https://cve.now/CVE-2026-93593.md): ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission (CVSS 8.6, ArcadeData arcadedb)
- [CVE-2026-93592](https://cve.now/CVE-2026-93592.md): vLLM before 0.28.0 Denial of Service via negative token ID (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-93591](https://cve.now/CVE-2026-93591.md): SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go (CVSS 7.2, siyuan-note siyuan)
- [CVE-2026-93590](https://cve.now/CVE-2026-93590.md): ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder (CVSS 6.3, ImageMagick)
- [CVE-2026-93589](https://cve.now/CVE-2026-93589.md): ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder (CVSS 6.3, ImageMagick)
- [CVE-2026-93588](https://cve.now/CVE-2026-93588.md): ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM (CVSS 2.3, ImageMagick)
- [CVE-2026-93587](https://cve.now/CVE-2026-93587.md): ImageMagick before 7.1.2-31 Policy Bypass via PCD decoder (CVSS 4.8, ImageMagick)
- [CVE-2026-93586](https://cve.now/CVE-2026-93586.md): ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob (CVSS 2.1, ImageMagick)
- [CVE-2023-5778](https://cve.now/CVE-2023-5778.md): Missing Length Check (CVSS 7.5, ABB Freelance Controller DCP · ABB Freelance Controller… +2)
- [CVE-2026-93504](https://cve.now/CVE-2026-93504.md): SveltyCMS User Attribute Update Endpoint +server.ts access control (CVSS 5.3, SveltyCMS)
- [CVE-2026-93492](https://cve.now/CVE-2026-93492.md): Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size (CVSS 5.3, Red Hat Build of Debezium · Red Hat build of Quarkus 3.… +10)
- [CVE-2026-93491](https://cve.now/CVE-2026-93491.md): Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12)
- [CVE-2026-93488](https://cve.now/CVE-2026-93488.md): Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12)
- [CVE-2026-28199](https://cve.now/CVE-2026-28199.md): Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell (CVSS 4.8, Cohesity NetBackup Flex OS)
- [CVE-2026-21806](https://cve.now/CVE-2026-21806.md): HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806) (CVSS 3.1, HCL Software HCL BigFix Service Management)
- [CVE-2026-28198](https://cve.now/CVE-2026-28198.md): Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell (CVSS 9.4, Cohesity NetBackup Flex OS)
- [CVE-2026-28197](https://cve.now/CVE-2026-28197.md): Privilege Escalation via Argument Injection in NetBackup Flex OS Shell (CVSS 9.4, Cohesity NetBackup Flex OS)
- [CVE-2026-93563](https://cve.now/CVE-2026-93563.md): Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos (CVSS 7.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +2)
- [CVE-2026-81627](https://cve.now/CVE-2026-81627.md): Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram (CVSS 8.2, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1)
- [CVE-2026-93578](https://cve.now/CVE-2026-93578.md): Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass (CVSS 5.9, Red Hat build of Apache Camel for Spring Boot)
- [CVE-2026-93572](https://cve.now/CVE-2026-93572.md): Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits (CVSS 7.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +2)
- [CVE-2026-93575](https://cve.now/CVE-2026-93575.md): Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder (CVSS 7.5, Red Hat AMQ Broker · Red Hat build of Apache Camel for S… +3)
- [CVE-2026-93561](https://cve.now/CVE-2026-93561.md): Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling (CVSS 6.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +2)
- [CVE-2026-92976](https://cve.now/CVE-2026-92976.md): Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0 (CVSS 5.1, T-Systems TAO)
- [CVE-2026-87743](https://cve.now/CVE-2026-87743.md): Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security (CVSS 7.5, Red Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Q… +9)
- [CVE-2026-15579](https://cve.now/CVE-2026-15579.md): An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length dur (CVSS 8.8, Moxa TN-4500B Series)
- [CVE-2026-87915](https://cve.now/CVE-2026-87915.md): Popup Maker \<= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values\[Name\] Parameter (CVSS 7.2, danieliser Popup Maker – Boost Sales, Conversions, Optins,…)
- [CVE-2026-15797](https://cve.now/CVE-2026-15797.md): Popup Maker \<= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post\_title (CVSS 6.4, danieliser Popup Maker – Boost Sales, Conversions, Optins,…)
- [CVE-2026-90884](https://cve.now/CVE-2026-90884.md): WP Recipe Maker \<= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint (CVSS 5.4, brechtvds WP Recipe Maker)
- [CVE-2026-18405](https://cve.now/CVE-2026-18405.md): Jeg Kit for Elementor \<= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2026-21822](https://cve.now/CVE-2026-21822.md): A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822). (CVSS 6.3, HCL Software HCL AppScan 360°)
- [CVE-2026-40539](https://cve.now/CVE-2026-40539.md): An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and (CVSS 7.1, Synology DiskStation Manager)
- [CVE-2026-40538](https://cve.now/CVE-2026-40538.md): An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1- (CVSS 3.7, Synology DiskStation Manager)
- [CVE-2026-40535](https://cve.now/CVE-2026-40535.md): An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manag (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2026-40533](https://cve.now/CVE-2026-40533.md): An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69 (CVSS 5.3, Synology DiskStation Manager)
- [CVE-2026-85410](https://cve.now/CVE-2026-85410.md): Master Addons for Elementor \<= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup\_id' Parameter (CVSS 8.1, pixarlabs Master Addons for Elementor – Elementor Addons, W…)
- [CVE-2026-83561](https://cve.now/CVE-2026-83561.md): Complianz GDPR/CCPA Cookie Consent Banner \<= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex (CVSS 7.2, Complianz GDPR/CCPA Cookie Consent Banner)
- [CVE-2025-13533](https://cve.now/CVE-2025-13533.md): CSS & JavaScript Toolbox \<= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields (CVSS 4.4, wipeoutmedia CSS & JavaScript Toolbox)
- [CVE-2026-40537](https://cve.now/CVE-2026-40537.md): A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280 (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-40536](https://cve.now/CVE-2026-40536.md): An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-40534](https://cve.now/CVE-2026-40534.md): An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation M (CVSS 5.4, Synology DiskStation Manager)
- [CVE-2026-40532](https://cve.now/CVE-2026-40532.md): A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280 (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2026-40531](https://cve.now/CVE-2026-40531.md): An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-4036](https://cve.now/CVE-2026-4036.md): An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2026-40530](https://cve.now/CVE-2026-40530.md): An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1 (CVSS 8.0, Synology DiskStation Manager)
- [CVE-2026-56595](https://cve.now/CVE-2026-56595.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 3.1, HCL Software HCL BigFix Service Management)
- [CVE-2026-56597](https://cve.now/CVE-2026-56597.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 3.1, HCL Software HCL BigFix Service Management)
- [CVE-2026-56592](https://cve.now/CVE-2026-56592.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 6.5, HCL Software HCL BigFix Service Management)
- [CVE-2026-13683](https://cve.now/CVE-2026-13683.md): An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology Disk (CVSS 2.7, Synology DiskStation Manager)
- [CVE-2026-13623](https://cve.now/CVE-2026-13623.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation M (CVSS 4.8, Synology DiskStation Manager)
- [CVE-2026-13666](https://cve.now/CVE-2026-13666.md): An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7. (CVSS 3.5, Synology DiskStation Manager)
- [CVE-2026-56590](https://cve.now/CVE-2026-56590.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 6.4, HCL Software HCL BigFix Service Management)
- [CVE-2026-6205](https://cve.now/CVE-2026-6205.md): An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280 (CVSS 8.1, Synology DiskStation Manager)
- [CVE-2026-13673](https://cve.now/CVE-2026-13673.md): An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057- (CVSS 8.8, Synology DiskStation Manager)
- [CVE-2026-13635](https://cve.now/CVE-2026-13635.md): An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280 (CVSS 5.3, Synology DiskStation Manager)
- [CVE-2026-13639](https://cve.now/CVE-2026-13639.md): An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009 (CVSS 9.8, Synology DiskStation Manager)
- [CVE-2026-21848](https://cve.now/CVE-2026-21848.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 5.0, HCL Software HCL BigFix Service Management)
- [CVE-2026-13684](https://cve.now/CVE-2026-13684.md): An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12… (CVSS 9.8, Synology DiskStation Manager)
- [CVE-2026-11757](https://cve.now/CVE-2026-11757.md): Reflected XSS in KA Informatics' Bar Association Website (CVSS 6.1, KA Informatics Technologies Ltd. Bar Association Website)
- [CVE-2026-93493](https://cve.now/CVE-2026-93493.md): Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field (CVSS 5.9, Red Hat build of Apache Camel for Spring Boot)
- [CVE-2026-67103](https://cve.now/CVE-2026-67103.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 7.6, HCL Software HCL BigFix Service Management)
- [CVE-2026-67102](https://cve.now/CVE-2026-67102.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 8.1, HCL Software HCL BigFix Service Management)
- [CVE-2026-67100](https://cve.now/CVE-2026-67100.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 9.8, HCL Software HCL BigFix Service Management)
- [CVE-2026-75157](https://cve.now/CVE-2026-75157.md): Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) (CVSS 7.5, Apache Software Foundation Apache Airflow)
- [CVE-2026-67101](https://cve.now/CVE-2026-67101.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 9.3, HCL Software HCL BigFix Service Management)
- [CVE-2026-12384](https://cve.now/CVE-2026-12384.md): Broken Access Control in TECHIN2B Application (CVSS 8.8, TECHIN2B Application)
- [CVE-2026-85705](https://cve.now/CVE-2026-85705.md): Location Manager \<= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters (CVSS 7.5, AyeCode Location Manager)
- [CVE-2026-92249](https://cve.now/CVE-2026-92249.md): Qi Addons For Elementor \<= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter (CVSS 6.1, qodeinteractive Qi Addons For Elementor)
- [CVE-2026-15275](https://cve.now/CVE-2026-15275.md): WP Multi Store Locator Pro \<= 4.5.1 - Unauthenticated SQL Injection via 'store\_locator\_search\_radius' Parameter (CVSS 7.5, wpexpertsio WP Multi Store Locator Pro)
- [CVE-2026-12739](https://cve.now/CVE-2026-12739.md): WP Easy Pay \<= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 4.3, saadiqbal WP Easy Pay – Payment and Donation Form Builder f…)
- [CVE-2026-85652](https://cve.now/CVE-2026-85652.md): Photo Gallery by 10Web \<= 1.8.44 - Authenticated (Author+) SQL Injection via 'album\_id' Shortcode Attribute (CVSS 6.5, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2026-16777](https://cve.now/CVE-2026-16777.md): Store Exporter \<= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter (CVSS 4.9, jkohlbach Store Exporter – Export WooCommerce Products, Ord…)
- [CVE-2026-15004](https://cve.now/CVE-2026-15004.md): FileBird – WordPress Media Library Folders & File Manager \<= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 5.4, ninjateam FileBird – WordPress Media Library Folders & File…)
- [CVE-2026-12954](https://cve.now/CVE-2026-12954.md): Mapster WP Maps \<= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter (CVSS 8.8, Mapster WP Maps)
- [CVE-2026-14472](https://cve.now/CVE-2026-14472.md): Kubio AI Page Builder \<= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content (CVSS 6.4, extendthemes Kubio AI Page Builder)
- [CVE-2026-14323](https://cve.now/CVE-2026-14323.md): Printcart Web to Print Product Designer for WooCommerce \<= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters (CVSS 7.5, Printcart Store – Web to Print Product Designer for WooComm…)
- [CVE-2026-75961](https://cve.now/CVE-2026-75961.md): NEX-Forms \<= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional\_params' Parameter (CVSS 4.9, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-92622](https://cve.now/CVE-2026-92622.md): Strong Testimonials \<= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox\_class' Shortcode Attribute (CVSS 6.4, wpchill Strong Testimonials)
- [CVE-2026-90981](https://cve.now/CVE-2026-90981.md): Newsletter \<= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter (CVSS 6.1, satollo Newsletter – Send awesome emails from WordPress)
- [CVE-2026-13471](https://cve.now/CVE-2026-13471.md): LatePoint \<= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) (CVSS 4.3, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-17607](https://cve.now/CVE-2026-17607.md): WP Inventory Manager \<= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute (CVSS 6.5, chuck1982 WP Inventory Manager)
- [CVE-2026-18442](https://cve.now/CVE-2026-18442.md): WCFM Marketplace \<= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp\_user\_location\_lat' / 'wcfmmp\_user\_location\_lng' Parameter (CVSS 7.5, wclovers WCFM Marketplace – Multivendor Marketplace for Woo…)
- [CVE-2026-92554](https://cve.now/CVE-2026-92554.md): ShopLentor \<= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name (CVSS 6.1, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2026-17586](https://cve.now/CVE-2026-17586.md): VK All in One Expansion Unit \<= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit\_cta\_img\_position' Post Meta (CVSS 6.4, kurudrive VK All in One Expansion Unit)
- [CVE-2026-93494](https://cve.now/CVE-2026-93494.md): Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated (CVSS 7.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +2)
- [CVE-2026-89058](https://cve.now/CVE-2026-89058.md): Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config (CVSS 7.4, Red Hat RESTEasy · Red Hat build of Quarkus 3.27.6.redh… +11)
- [CVE-2026-89059](https://cve.now/CVE-2026-89059.md): Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) (CVSS 7.5, Red Hat RESTEasy · Red Hat build of Quarkus 3.27.6.redh… +11)
- [CVE-2024-38639](https://cve.now/CVE-2024-38639.md): QTS (CVSS 4.8, QNAP Systems QTS)
- [CVE-2024-27123](https://cve.now/CVE-2024-27123.md): QcalAgent (CVSS 5.2, QNAP Systems QcalAgent)
- [CVE-2026-92561](https://cve.now/CVE-2026-92561.md): Booking Calendar \<= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter (CVSS 6.1, wpdevelop Booking Calendar)
- [CVE-2026-89330](https://cve.now/CVE-2026-89330.md): EmbedPress \<= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters (CVSS 6.1, wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Googl…)
- [CVE-2026-89278](https://cve.now/CVE-2026-89278.md): GPTranslate \<= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script (CVSS 5.3, john-dagelmore GPTranslate – Multilingual AI Translation Ag…)
- [CVE-2026-84909](https://cve.now/CVE-2026-84909.md): Custom Twitter Feeds \<= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute (CVSS 6.4, smub Custom Twitter Feeds – A Tweets Widget or X Feed Widget)
- [CVE-2026-12106](https://cve.now/CVE-2026-12106.md): Auto Upload Images \<= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of \<img\> Tags (CVSS 6.4, airani Auto Upload Images)
- [CVE-2026-92619](https://cve.now/CVE-2026-92619.md): Booking Calendar \<= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data\_name' Parameter (CVSS 7.2, wpdevelop Booking Calendar)
- [CVE-2026-75017](https://cve.now/CVE-2026-75017.md): Magazine Blocks \<= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint (CVSS 4.3, wpblockart Magazine Blocks – Blog Designer, Magazine & News…)
- [CVE-2026-91707](https://cve.now/CVE-2026-91707.md): Divi \<= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint (CVSS 5.3, Elegant Themes Divi)
- [CVE-2026-89138](https://cve.now/CVE-2026-89138.md): Filter Gallery \<= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image\_id' Parameter via ufg\_save\_gallery AJAX Action (CVSS 4.3, farazfrank Filter Gallery)
- [CVE-2026-92714](https://cve.now/CVE-2026-92714.md): Download Manager \<= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm\_duplicate' Parameter (CVSS 6.5, codename065 Download Manager)
- [CVE-2026-75016](https://cve.now/CVE-2026-75016.md): Magazine Blocks \<= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute (CVSS 6.4, wpblockart Magazine Blocks – Blog Designer, Magazine & News…)
- [CVE-2026-18317](https://cve.now/CVE-2026-18317.md): Foxtool All-in-One: Contact chat button, Custom login, Media optimize images \<= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option\_key' Parameter of toggle\_watermark AJAX Action (CVSS 4.3, foxtheme Foxtool All-in-One: Contact chat button, Custom lo…)
- [CVE-2026-17576](https://cve.now/CVE-2026-17576.md): InfiniteWP Client \<= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp\_get\_comments\_\*' Array Key (CVSS 6.5, revmakx InfiniteWP Client)
- [CVE-2026-89413](https://cve.now/CVE-2026-89413.md): Filter Gallery \<= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg\_gallery\_id' Parameter (CVSS 8.1, farazfrank Filter Gallery)
- [CVE-2026-90977](https://cve.now/CVE-2026-90977.md): Clean Login \< 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison (CVSS 5.3, Clean Login)
- [CVE-2026-90976](https://cve.now/CVE-2026-90976.md): Clean Login \< 1.19 - Unauthenticated Account Creation with Registration Disabled (CVSS 5.3, Clean Login)
- [CVE-2026-88994](https://cve.now/CVE-2026-88994.md): All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes (CVSS 6.6, All Bootstrap Blocks)
- [CVE-2026-86800](https://cve.now/CVE-2026-86800.md): WP Ghost (Hide My WP Ghost) \< 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check (CVSS 5.3, Hide My WP Ghost)
- [CVE-2026-86796](https://cve.now/CVE-2026-86796.md): WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters (CVSS 5.3, Hide My WP Ghost)
- [CVE-2026-79713](https://cve.now/CVE-2026-79713.md): Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters (CVSS 6.5, Breeze Cache)
- [CVE-2026-90984](https://cve.now/CVE-2026-90984.md): Generate PDF using Contact Form 7 \< 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field (CVSS 5.8, Generate PDF using Contact Form)
- [CVE-2026-90978](https://cve.now/CVE-2026-90978.md): Filter Gallery \< 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check (CVSS 7.1, Filter Gallery)
- [CVE-2026-89008](https://cve.now/CVE-2026-89008.md): Bookit \< 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure (CVSS 2.7, Bookit — Booking & Appointment Calendar)
- [CVE-2026-89007](https://cve.now/CVE-2026-89007.md): Bookit \< 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization (CVSS 2.7, Bookit — Booking & Appointment Calendar)
- [CVE-2026-88993](https://cve.now/CVE-2026-88993.md): All Bootstrap Blocks \<= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute (CVSS 6.8, All Bootstrap Blocks)
- [CVE-2026-88844](https://cve.now/CVE-2026-88844.md): MasterStudy LMS 3.6.2 - \< 3.7.50 - Instructor+ Student PII Disclosure via IDOR (CVSS 2.7, MasterStudy LMS WordPress Plugin)
- [CVE-2026-88825](https://cve.now/CVE-2026-88825.md): iGMS Direct Booking \< 2.0 - Unauthenticated Stored XSS via Widget Settings (CVSS 8.8, iGMS Direct Booking)
- [CVE-2026-88798](https://cve.now/CVE-2026-88798.md): Really Simple Security (Free) \< 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header (CVSS 5.3, Really Simple Security)
- [CVE-2026-87966](https://cve.now/CVE-2026-87966.md): Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR (CVSS 5.3, Easy Appointments)
- [CVE-2026-87965](https://cve.now/CVE-2026-87965.md): Easy Appointments \< 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token (CVSS 4.8, Easy Appointments)
- [CVE-2026-87775](https://cve.now/CVE-2026-87775.md): Tz Weekly Radio Schedule \<= 1.8.1 - Unauthenticated SQLi via tzwrs\_update\_cell (CVSS 8.6, Tz Weekly Radio Schedule)
- [CVE-2026-87774](https://cve.now/CVE-2026-87774.md): Tz Weekly Radio Schedule \<= 1.8.1 - Unauthenticated SQL Injection via week (CVSS 8.6, Tz Weekly Radio Schedule)
- [CVE-2026-87771](https://cve.now/CVE-2026-87771.md): Product Question and Answer \<= 1.1.0 - Unauthenticated SQL Injection via p\_id and read (CVSS 8.6, Product Question and Answer)
- [CVE-2026-87770](https://cve.now/CVE-2026-87770.md): Price Drop Alert for WooCommerce \<= 1.1 - Unauthenticated SQL Injection via product (CVSS 8.6, Price Drop Alert for Woo Commerce)
- [CVE-2026-87767](https://cve.now/CVE-2026-87767.md): WP Shortcut Link \<= 1.2.0 - Unauthenticated SQL Injection via url (CVSS 8.6, wp shortcut link and advertisement baner)
- [CVE-2026-85350](https://cve.now/CVE-2026-85350.md): UpsellWP \< 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together (CVSS 5.3, UpsellWP)
- [CVE-2026-85127](https://cve.now/CVE-2026-85127.md): VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment (CVSS 8.8, VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-85123](https://cve.now/CVE-2026-85123.md): Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion (CVSS 5.3, Easy Form Builder by WhiteStudio)
- [CVE-2026-85122](https://cve.now/CVE-2026-85122.md): Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion (CVSS 8.8, Easy Form Builder by WhiteStudio)
- [CVE-2026-85009](https://cve.now/CVE-2026-85009.md): RestroPress \<= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery (CVSS 6.5, RestroPress)
- [CVE-2026-84904](https://cve.now/CVE-2026-84904.md): King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer (CVSS 3.8, King Addons for Elementor)
- [CVE-2026-84903](https://cve.now/CVE-2026-84903.md): King Addons for Elementor \< 51.1.81 - Contributor+ Private Post Content Disclosure via kng\_maintenance\_page Shortcode (CVSS 2.7, King Addons for Elementor)
- [CVE-2026-84902](https://cve.now/CVE-2026-84902.md): King Addons for Elementor \< 51.1.81 - Contributor+ Stored XSS via Template Catalog Import (CVSS 6.8, King Addons for Elementor)
- [CVE-2026-84738](https://cve.now/CVE-2026-84738.md): AF Companion \< 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE (CVSS 9.1, AF Companion)
- [CVE-2026-81810](https://cve.now/CVE-2026-81810.md): All-in-One WP Migration and Backup \< 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure (CVSS 7.2, All-in-One WP Migration and Backup)
- [CVE-2026-81340](https://cve.now/CVE-2026-81340.md): MasterStudy LMS \< 3.7.50 - Instructor+ Order Status Manipulation via IDOR (CVSS 3.8, MasterStudy LMS WordPress Plugin)
- [CVE-2026-93485](https://cve.now/CVE-2026-93485.md): WordPress Core \<= 7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Automattic WordPress)
- [CVE-2026-18912](https://cve.now/CVE-2026-18912.md): ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticate (CVSS 7.7, Zohocorp ManageEngine DataSecurity Plus)
- [CVE-2026-18911](https://cve.now/CVE-2026-18911.md): ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send req (CVSS 7.5, Zohocorp ManageEngine DataSecurity Plus)
- [CVE-2026-17086](https://cve.now/CVE-2026-17086.md): ShortPixel Image Optimizer \<= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content (CVSS 8.8, ShortPixel Image Optimizer – Optimize Images, Convert WebP…)
- [CVE-2026-92991](https://cve.now/CVE-2026-92991.md): Biggopti Library (Various Versions) - Cross-Site Scripting via display\_id from Sigmative API (CVSS 5.4, bdthemes Live Copy Paste for Elementor – Cross Domain Co… +5)
- [CVE-2026-14855](https://cve.now/CVE-2026-14855.md): RT Mega Menu \<= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega\_update\_menu\_options AJAX Action (CVSS 6.4, themewant RT Mega Menu – Mega Menu Builder for Elementor &…)
- [CVE-2026-15650](https://cve.now/CVE-2026-15650.md): RT Mega Menu \<= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer\_menu\_item' Block Attribute (CVSS 6.4, themewant RT Mega Menu – Mega Menu Builder for Elementor &…)
- [CVE-2026-93468](https://cve.now/CVE-2026-93468.md): HGiga｜OAKlouds - Arbitrary File Read (CVSS 8.7, HGiga OAKlouds-bulletin\_v3-2.0 · HGiga OAKlouds-bulletin\_v3…)
- [CVE-2026-93467](https://cve.now/CVE-2026-93467.md): HGiga｜OAKlouds - Insecure Deserialization (CVSS 9.3, HGiga OAKlouds-custom\_page-2.0 · HGiga OAKlouds-custom\_p… +1)
- [CVE-2026-93371](https://cve.now/CVE-2026-93371.md): marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection (CVSS 6.9, marcopiovanello yt-dlp-web-ui)
- [CVE-2026-93331](https://cve.now/CVE-2026-93331.md): GPAC RTP Depacketizer rtp\_depacketizer.c gf\_rtp\_parse\_ttxt out-of-bounds (CVSS 6.9, GPAC)
- [CVE-2026-93314](https://cve.now/CVE-2026-93314.md): Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow (CVSS 5.3, Freedesktop Poppler)
- [CVE-2026-68493](https://cve.now/CVE-2026-68493.md): After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they ar (CVSS 3.1, Nextcloud Server)
- [CVE-2026-77164](https://cve.now/CVE-2026-77164.md): Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, (CVSS 6.2, Nextcloud Server)
- [CVE-2026-82985](https://cve.now/CVE-2026-82985.md): The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewi (CVSS 6.5, Nextcloud Server)
- [CVE-2026-77170](https://cve.now/CVE-2026-77170.md): The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the (CVSS 4.3, Nextcloud Deck)
- [CVE-2026-82982](https://cve.now/CVE-2026-82982.md): The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app (CVSS 4.3, Nextcloud Approval)
- [CVE-2026-77169](https://cve.now/CVE-2026-77169.md): A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only deleg (CVSS 6.5, Nextcloud Team Folders)
- [CVE-2026-82980](https://cve.now/CVE-2026-82980.md): Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. (CVSS 6.3, Nextcloud Files Lock)
- [CVE-2026-93456](https://cve.now/CVE-2026-93456.md): django-page-cms through 2.0.13 CSRF via admin mutation views (CVSS 8.4, batiste django-page-cms)
- [CVE-2026-93455](https://cve.now/CVE-2026-93455.md): django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account (CVSS 7.1, batiste django-page-cms)
- [CVE-2026-93313](https://cve.now/CVE-2026-93313.md): Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow (CVSS 5.3, Freedesktop Poppler)
- [CVE-2026-93312](https://cve.now/CVE-2026-93312.md): Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference (CVSS 5.3, Freedesktop Poppler)
- [CVE-2026-93311](https://cve.now/CVE-2026-93311.md): Freedesktop Poppler SampledFunction Function.cc integer overflow (CVSS 5.3, Freedesktop Poppler)
- [CVE-2026-79954](https://cve.now/CVE-2026-79954.md): NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID (CVSS 8.7, NASA CryptoLib)
- [CVE-2026-93310](https://cve.now/CVE-2026-93310.md): O-RAN-SC SMO OAM VES Collector allocation of resources (CVSS 6.9, O-RAN-SC SMO OAM)
- [CVE-2026-79294](https://cve.now/CVE-2026-79294.md): Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the H (CVSS 6.1)
- [CVE-2026-88622](https://cve.now/CVE-2026-88622.md): NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle\_import\_privilege.php. (CVSS 8.8)
- [CVE-2026-88623](https://cve.now/CVE-2026-88623.md): NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.