# CVEs published 2026-09-21

285 CVEs were published on September 21, 2026: 31 critical, 104 high. Days are UTC.

- [CVE-2026-94426](https://cve.now/CVE-2026-94426.md): xuxueli xxl-job insert cross site scripting (CVSS 5.1, xuxueli xxl-job)
- [CVE-2026-94425](https://cve.now/CVE-2026-94425.md): Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub\_140006F0C privileges management (CVSS 9.3, Moore Threads MTT S80 Driver Package)
- [CVE-2026-94627](https://cve.now/CVE-2026-94627.md): vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision (CVSS 8.7, vllm-project vllm)
- [CVE-2026-94626](https://cve.now/CVE-2026-94626.md): vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp\_size (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-94625](https://cve.now/CVE-2026-94625.md): vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders (CVSS 6.9, vllm-project vllm · vllm)
- [CVE-2026-94624](https://cve.now/CVE-2026-94624.md): vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-94623](https://cve.now/CVE-2026-94623.md): vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-94622](https://cve.now/CVE-2026-94622.md): vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-94540](https://cve.now/CVE-2026-94540.md): DesktopSMS 1.11.0 Unauthorized Access via Local Service (CVSS 7.4, MrPear DesktopSMS)
- [CVE-2026-65980](https://cve.now/CVE-2026-65980.md): Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution (CVSS 7.9, chartbrew)
- [CVE-2026-61851](https://cve.now/CVE-2026-61851.md): Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool (CVSS 6.5, chartbrew)
- [CVE-2026-61852](https://cve.now/CVE-2026-61852.md): Chartbrew: SQL Injection via row\_limit Parameter in AI runQuery Tool (CVSS 5.8, chartbrew)
- [CVE-2026-61743](https://cve.now/CVE-2026-61743.md): Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation (CVSS 6.3, chartbrew)
- [CVE-2026-94536](https://cve.now/CVE-2026-94536.md): lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource (CVSS 4.3, dromara lamp-cloud)
- [CVE-2026-94535](https://cve.now/CVE-2026-94535.md): lamp-cloud through 5.10.0 Unauthorized Notification Deletion (CVSS 7.1, dromara lamp-cloud)
- [CVE-2026-94534](https://cve.now/CVE-2026-94534.md): lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints (CVSS 7.1, dromara lamp-cloud)
- [CVE-2026-94533](https://cve.now/CVE-2026-94533.md): lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file (CVSS 6.5, dromara lamp-cloud)
- [CVE-2026-94532](https://cve.now/CVE-2026-94532.md): lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById (CVSS 6.5, dromara lamp-cloud)
- [CVE-2026-93340](https://cve.now/CVE-2026-93340.md): Gladys Assistant \< 5.1.0 Password Reset Link Poisoning via forgot\_password Endpoint (CVSS 7.4, Gladys Assistant)
- [CVE-2026-61541](https://cve.now/CVE-2026-61541.md): Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service (CVSS 6.9, kap-sh zapros · zapros)
- [CVE-2026-59830](https://cve.now/CVE-2026-59830.md): Discourse: Stored XSS via unescaped actor name in post actions (CVSS 5.4, discourse)
- [CVE-2026-46650](https://cve.now/CVE-2026-46650.md): Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl (CVSS 4.4, laurent22 joplin)
- [CVE-2026-17054](https://cve.now/CVE-2026-17054.md): Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly (CVSS 5.3, zephyrproject zephyr)
- [CVE-2026-15890](https://cve.now/CVE-2026-15890.md): AEAD nonce reuse in Zephyr secure\_storage ITS default nonce provider due to missing thread synchronization (CVSS 5.3, zephyrproject zephyr)
- [CVE-2026-59815](https://cve.now/CVE-2026-59815.md): Joplin: Pending share recipients can write items into shared folders before accepting invitations (CVSS 4.3, laurent22 joplin)
- [CVE-2026-55210](https://cve.now/CVE-2026-55210.md): Joplin: SAML SSO account takeover via email-based account linking (missing is\_external check in ssoLogin) (CVSS 7.4, laurent22 joplin)
- [CVE-2026-61652](https://cve.now/CVE-2026-61652.md): Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb) (CVSS 8.7, kap-sh zapros · zapros)
- [CVE-2026-59814](https://cve.now/CVE-2026-59814.md): Joplin: Stored XSS via inline-served note attachment on published shares (CVSS 7.6, laurent22 joplin)
- [CVE-2026-61647](https://cve.now/CVE-2026-61647.md): @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory (CVSS 7.1, roomi-fields notebooklm-mcp · @roomi-fields/notebooklm-mcp)
- [CVE-2026-55105](https://cve.now/CVE-2026-55105.md): Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer (CVSS 7.7, laurent22 joplin)
- [CVE-2026-46649](https://cve.now/CVE-2026-46649.md): Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint (CVSS 9.1, laurent22 joplin)
- [CVE-2026-55179](https://cve.now/CVE-2026-55179.md): Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID (CVSS 6.5, laurent22 joplin)
- [CVE-2026-59816](https://cve.now/CVE-2026-59816.md): Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash (CVSS 4.3, laurent22 joplin)
- [CVE-2026-49449](https://cve.now/CVE-2026-49449.md): Joplin: KaTeX \`trust:true\` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows (CVSS 2.5, laurent22 joplin)
- [CVE-2026-49453](https://cve.now/CVE-2026-49453.md): Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory (CVSS 7.0, laurent22 joplin)
- [CVE-2026-49450](https://cve.now/CVE-2026-49450.md): Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName (CVSS 7.1, laurent22 joplin)
- [CVE-2026-79919](https://cve.now/CVE-2026-79919.md): MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD\_NEXT) (CVSS 6.3, 1Panel-dev MaxKB)
- [CVE-2026-79918](https://cve.now/CVE-2026-79918.md): MaxKB: Sandbox escape via unhooked fexecve (CVSS 6.3, 1Panel-dev MaxKB)
- [CVE-2026-94588](https://cve.now/CVE-2026-94588.md): In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. (CVSS 4.4, Proxmox pmg-api)
- [CVE-2026-77517](https://cve.now/CVE-2026-77517.md): MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base (CVSS 5.4, 1Panel-dev MaxKB)
- [CVE-2026-77521](https://cve.now/CVE-2026-77521.md): MaxKB: Prompt-injectable agent can lead to command execution (CVSS 10.0, 1Panel-dev MaxKB)
- [CVE-2026-94424](https://cve.now/CVE-2026-94424.md): Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub\_140001000 heap-based overflow (CVSS 9.3, Moore Threads MTT S80 Driver Package)
- [CVE-2026-77522](https://cve.now/CVE-2026-77522.md): MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind) (CVSS 4.3, 1Panel-dev MaxKB)
- [CVE-2026-79917](https://cve.now/CVE-2026-79917.md): MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation (CVSS 6.5, 1Panel-dev MaxKB)
- [CVE-2026-77516](https://cve.now/CVE-2026-77516.md): MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path (CVSS 5.4, 1Panel-dev MaxKB)
- [CVE-2026-77523](https://cve.now/CVE-2026-77523.md): MaxKB: Cross-workspace model parameter form write (CVSS 7.4, 1Panel-dev MaxKB)
- [CVE-2026-77525](https://cve.now/CVE-2026-77525.md): MaxKB: Management chat-record routes trust path application\_id but load ChatRecord by global chat\_id (CVSS 4.2, 1Panel-dev MaxKB)
- [CVE-2026-77518](https://cve.now/CVE-2026-77518.md): MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows (CVSS 5.0, 1Panel-dev MaxKB)
- [CVE-2026-79916](https://cve.now/CVE-2026-79916.md): MaxKB AWS Bedrock model credential injection leads to remote code execution (CVSS 9.1, 1Panel-dev MaxKB)
- [CVE-2026-58272](https://cve.now/CVE-2026-58272.md): Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) (CVSS 5.3, Sync-in server · @sync-in/server)
- [CVE-2026-58270](https://cve.now/CVE-2026-58270.md): Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff \`pathFilters\` (CVSS 6.5, Sync-in server · @sync-in/server)
- [CVE-2026-77520](https://cve.now/CVE-2026-77520.md): MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application (CVSS 5.4, 1Panel-dev MaxKB)
- [CVE-2026-77519](https://cve.now/CVE-2026-77519.md): MaxKB: Expired application API keys remain usable on \`/chat/api/mcp\` (CVSS 5.4, 1Panel-dev MaxKB)
- [CVE-2026-73511](https://cve.now/CVE-2026-73511.md): Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) (CVSS 5.3, envoyproxy envoy)
- [CVE-2026-73553](https://cve.now/CVE-2026-73553.md): Envoy: RBAC Authorization Bypass via Path Parameters (CVSS 7.5, envoyproxy envoy)
- [CVE-2026-73551](https://cve.now/CVE-2026-73551.md): Envoy: Path normalization does not handle dot and dotdot segments with parameters (CVSS 5.3, envoyproxy envoy · envoy)
- [CVE-2026-94572](https://cve.now/CVE-2026-94572.md): In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls\_ciphers field for control charact (CVSS 9.4, OpenStack Octavia)
- [CVE-2026-93433](https://cve.now/CVE-2026-93433.md): Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-94571](https://cve.now/CVE-2026-94571.md): In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect\_url and redirect (CVSS 9.4, OpenStack Octavia)
- [CVE-2026-58269](https://cve.now/CVE-2026-58269.md): Sync-in Server has a complete 2FA Bypass via \`POST /api/auth/token\` (CVSS 8.1, Sync-in server · @sync-in/server)
- [CVE-2026-73546](https://cve.now/CVE-2026-73546.md): Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) (CVSS 7.4, envoyproxy envoy)
- [CVE-2026-73512](https://cve.now/CVE-2026-73512.md): Envoy: use-after-free in QUIC on internal redirects (CVSS 7.5, envoyproxy envoy)
- [CVE-2026-58271](https://cve.now/CVE-2026-58271.md): @sync-in/server vulnerable to TOTP Brute-Force via \`POST /api/app/sync/register\` (CVSS 6.8, Sync-in server · @sync-in/server)
- [CVE-2026-73550](https://cve.now/CVE-2026-73550.md): Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy (CVSS 7.5, envoyproxy envoy · envoy)
- [CVE-2026-73547](https://cve.now/CVE-2026-73547.md): Envoy ext\_authz: request \`:path\` pseudoheader dereferenced w/o null check (CVSS 7.5, envoyproxy envoy)
- [CVE-2026-48521](https://cve.now/CVE-2026-48521.md): Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport\_socket\_options is null (CVSS 5.9, envoyproxy envoy)
- [CVE-2026-73549](https://cve.now/CVE-2026-73549.md): Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL\_DST clusters (CVSS 5.3, envoyproxy envoy)
- [CVE-2026-73513](https://cve.now/CVE-2026-73513.md): Envoy: oghttp2 upstream trailers incorrect handling (CVSS 7.5, envoyproxy envoy · envoy)
- [CVE-2026-85219](https://cve.now/CVE-2026-85219.md): Denial-of-Service in the OpenCanary Redis service (CVSS 3.7, Thinkst Applied Research OpenCanary)
- [CVE-2026-49811](https://cve.now/CVE-2026-49811.md): Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. (CVSS 8.4, Dell Command | Monitor)
- [CVE-2026-73552](https://cve.now/CVE-2026-73552.md): Envoy: HTTP RBAC safe\_regex can fail open on RFC-valid obs-text header values (CVSS 7.5, envoyproxy envoy)
- [CVE-2026-73548](https://cve.now/CVE-2026-73548.md): Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool (CVSS 7.5, envoyproxy envoy · envoy)
- [CVE-2026-50572](https://cve.now/CVE-2026-50572.md): Envoy: ext\_authz - RawHttpClientImpl onSuccess 0x0 segfault (CVSS 5.9, envoyproxy envoy)
- [CVE-2026-55897](https://cve.now/CVE-2026-55897.md): luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root (CVSS 8.8, openwrt luci)
- [CVE-2026-81469](https://cve.now/CVE-2026-81469.md): Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. (CVSS 7.8, Dell Inventory Collector Client)
- [CVE-2026-55159](https://cve.now/CVE-2026-55159.md): luci-app-adblock-fast: Delegated \`luci-app-adblock-fast\` users can reach root command execution by injecting newline-separated cron entries (CVSS 8.8, openwrt luci-app-adblock-fast)
- [CVE-2026-45381](https://cve.now/CVE-2026-45381.md): Tautulli: Reflected XSS in \`/search\` endpoint (CVSS 5.1, Tautulli)
- [CVE-2026-49995](https://cve.now/CVE-2026-49995.md): Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter (CVSS 4.8, Tautulli)
- [CVE-2026-54915](https://cve.now/CVE-2026-54915.md): Tautulli: Open redirect via whitespace bypass in /auth/redirect (CVSS 5.4, Tautulli)
- [CVE-2026-52835](https://cve.now/CVE-2026-52835.md): Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import\_config and import\_database (CVSS 7.0, Tautulli)
- [CVE-2026-62247](https://cve.now/CVE-2026-62247.md): Supabase Realtime: Incorrect Authorization (CVSS 6.5, supabase realtime)
- [CVE-2026-91167](https://cve.now/CVE-2026-91167.md): Warpgate: Missing authorization check on \`PUT /users/:id/roles/:role\_id\` allows any admin to bypass the \`AccessRolesAssign\` permission boundary (CVSS 6.0, warp-tech warpgate)
- [CVE-2026-91166](https://cve.now/CVE-2026-91166.md): Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target (CVSS 5.7, warp-tech warpgate)
- [CVE-2026-91165](https://cve.now/CVE-2026-91165.md): Warpgate: Markup injection in SSO form\_post return page via unencoded redirect/error values (CVSS 2.4, warp-tech warpgate)
- [CVE-2026-91164](https://cve.now/CVE-2026-91164.md): Warpgate: API tokens bypass the user's allowed\_ip\_ranges restriction (CVSS 4.3, warp-tech warpgate)
- [CVE-2026-63330](https://cve.now/CVE-2026-63330.md): Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions (CVSS 7.7, warp-tech warpgate)
- [CVE-2026-63329](https://cve.now/CVE-2026-63329.md): Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets (CVSS 4.9, warp-tech warpgate)
- [CVE-2026-58491](https://cve.now/CVE-2026-58491.md): Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter (CVSS 9.3, warp-tech warpgate)
- [CVE-2026-61748](https://cve.now/CVE-2026-61748.md): InvenTree: Report/Label print endpoints ignore per-model permissions (CVSS 4.3, InvenTree)
- [CVE-2026-61746](https://cve.now/CVE-2026-61746.md): InvenTree: Plugin-settings GET endpoints are readable without authentication (CVSS 5.3, InvenTree)
- [CVE-2026-61744](https://cve.now/CVE-2026-61744.md): InvenTree: Barcode-scan API (\`POST /api/barcode/\`) returns full serialized object data without enforcing the model's view role (CVSS 6.5, InvenTree)
- [CVE-2026-61747](https://cve.now/CVE-2026-61747.md): InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (\`row\_data\`/\`data\`) and column mappings (CVSS 4.3, InvenTree)
- [CVE-2026-17052](https://cve.now/CVE-2026-17052.md): Missing user-pointer validation in tgpio\_pin\_read\_ts\_ec syscall handler allows arbitrary supervisor-memory write from userspace (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-61749](https://cve.now/CVE-2026-61749.md): InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure (CVSS 6.5, InvenTree)
- [CVE-2026-94403](https://cve.now/CVE-2026-94403.md): ColorFul iGameCenter IOCTL ene.sys sub\_140001AF0 untrusted pointer dereference (CVSS 9.3, ColorFul iGameCenter)
- [CVE-2026-82165](https://cve.now/CVE-2026-82165.md): Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. (CVSS 5.5, Dell Command | Integration Suite for System Center)
- [CVE-2026-49810](https://cve.now/CVE-2026-49810.md): Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. (CVSS 7.8, Dell Command Powershell Provider)
- [CVE-2026-94501](https://cve.now/CVE-2026-94501.md): jshERP through 3.6 Privilege Escalation via userBusiness CRUD (CVSS 8.8, jishenghua jshERP)
- [CVE-2026-94497](https://cve.now/CVE-2026-94497.md): jshERP through 3.6 Unauthorized Access via by-id Endpoints (CVSS 8.3, jishenghua jshERP)
- [CVE-2026-94496](https://cve.now/CVE-2026-94496.md): jshERP through 3.6 Privilege Escalation via Role Management (CVSS 8.3, jishenghua jshERP)
- [CVE-2026-94495](https://cve.now/CVE-2026-94495.md): jshERP through 3.6 Missing Authorization via systemConfig (CVSS 7.1, jishenghua jshERP)
- [CVE-2026-94494](https://cve.now/CVE-2026-94494.md): jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info (CVSS 5.0, jishenghua jshERP)
- [CVE-2026-94414](https://cve.now/CVE-2026-94414.md): jshERP through 3.6 Missing Authorization via updateBtnStr (CVSS 5.4, jishenghua jshERP)
- [CVE-2026-94413](https://cve.now/CVE-2026-94413.md): jshERP through 3.6 Password Hash Disclosure via /user/info (CVSS 6.5, jishenghua jshERP)
- [CVE-2026-94412](https://cve.now/CVE-2026-94412.md): jshERP through 3.6 Authorization Bypass via resetPwd (CVSS 8.8, jishenghua jshERP)
- [CVE-2026-94411](https://cve.now/CVE-2026-94411.md): jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType (CVSS 8.8, jishenghua jshERP)
- [CVE-2026-82163](https://cve.now/CVE-2026-82163.md): Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. (CVSS 5.5, Dell Command | Intel vPro Out of Band)
- [CVE-2026-61745](https://cve.now/CVE-2026-61745.md): InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment (CVSS 4.3, InvenTree)
- [CVE-2026-69190](https://cve.now/CVE-2026-69190.md): Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards (CVSS 6.3, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-55473](https://cve.now/CVE-2026-55473.md): HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress (CVSS 6.0, sysadminsmedia homebox)
- [CVE-2026-48826](https://cve.now/CVE-2026-48826.md): HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching (CVSS 8.1, sysadminsmedia homebox)
- [CVE-2026-48974](https://cve.now/CVE-2026-48974.md): HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler (CVSS 5.4, sysadminsmedia homebox)
- [CVE-2026-48975](https://cve.now/CVE-2026-48975.md): HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox (CVSS 8.1, sysadminsmedia homebox)
- [CVE-2026-48976](https://cve.now/CVE-2026-48976.md): HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack (CVSS 8.1, sysadminsmedia homebox)
- [CVE-2026-62182](https://cve.now/CVE-2026-62182.md): KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes (CVSS 8.8, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2026-61612](https://cve.now/CVE-2026-61612.md): @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 (CVSS 5.7, ondata ckan-mcp-server · @aborruso/ckan-mcp-server)
- [CVE-2026-94488](https://cve.now/CVE-2026-94488.md): Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (CVSS 8.3, Telegram Desktop)
- [CVE-2026-92382](https://cve.now/CVE-2026-92382.md): Usbredir: usbredir: unbounded iso\_packet\_desc\[\] index in usbredirhost\_iso\_packet() leads to heap out-of-bounds write (CVSS 4.1, Red Hat Enterprise Linux)
- [CVE-2026-93012](https://cve.now/CVE-2026-93012.md): Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in \_sendmail\_pipe (CVSS 9.8, Email-Sender)
- [CVE-2026-62369](https://cve.now/CVE-2026-62369.md): KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join (CVSS 8.1, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2026-62370](https://cve.now/CVE-2026-62370.md): KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub (CVSS 6.5, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2026-62371](https://cve.now/CVE-2026-62371.md): KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API (CVSS 8.8, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2026-94449](https://cve.now/CVE-2026-94449.md): Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service (CVSS 7.5, Red Hat build of Quarkus 3.27.6.redhat · Red Hat build o… +4)
- [CVE-2026-63116](https://cve.now/CVE-2026-63116.md): deepstream: PATCH\_MULTI action bypasses Valve permission system allowing unauthorized record writes (CVSS 8.8, deepstreamIO deepstream.io · @deepstream/server)
- [CVE-2026-59168](https://cve.now/CVE-2026-59168.md): Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS (CVSS 6.2, TomWright dasel · github.com/tomwright/dasel +2)
- [CVE-2026-62866](https://cve.now/CVE-2026-62866.md): Dasel: Selector lexer panics on trailing whitespace in \`parseCurRune\` (CVSS 6.2, TomWright dasel · github.com/tomwright/dasel +2)
- [CVE-2026-77561](https://cve.now/CVE-2026-77561.md): Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service (CVSS 5.3, tinyauthapp tinyauth · github.com/steveiliop56/tinyauth +1)
- [CVE-2026-77582](https://cve.now/CVE-2026-77582.md): Tinyauth: User enumeration attack by timing oracle (CVSS 6.9, tinyauthapp tinyauth · github.com/tinyauthapp/tinyauth)
- [CVE-2026-17051](https://cve.now/CVE-2026-17051.md): Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length (CVSS 6.0, zephyrproject zephyr)
- [CVE-2026-17050](https://cve.now/CVE-2026-17050.md): Double free of the USB host configuration descriptor when device enumeration fails (CVSS 5.7, zephyrproject zephyr)
- [CVE-2026-77560](https://cve.now/CVE-2026-77560.md): Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for (CVSS 8.1, tinyauthapp tinyauth · github.com/tinyauthapp/tinyauth)
- [CVE-2026-79920](https://cve.now/CVE-2026-79920.md): Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task (CVSS 9.9, ajenti)
- [CVE-2026-76898](https://cve.now/CVE-2026-76898.md): draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js (CVSS 7.7, jgraph drawio)
- [CVE-2026-63373](https://cve.now/CVE-2026-63373.md): draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection (CVSS 4.2, jgraph drawio)
- [CVE-2026-63334](https://cve.now/CVE-2026-63334.md): draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist (CVSS 6.8, jgraph drawio)
- [CVE-2026-63416](https://cve.now/CVE-2026-63416.md): draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints (CVSS 3.7, jgraph drawio)
- [CVE-2026-58504](https://cve.now/CVE-2026-58504.md): draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 (CVSS 6.1, jgraph drawio)
- [CVE-2026-62987](https://cve.now/CVE-2026-62987.md): Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header (CVSS 5.8, fabiolb fabio · github.com/fabiolb/fabio)
- [CVE-2026-61674](https://cve.now/CVE-2026-61674.md): Fluent Bit: Remote stack buffer overflow in Fluent Bit \`out\_forward\` Secure-Forward \`PONG\` handler (CVSS 9.2, fluent-bit)
- [CVE-2026-84990](https://cve.now/CVE-2026-84990.md): ntopng: Missing Authorization on System Configuration Backup Download and Listing (CVSS 8.8, ntopng)
- [CVE-2026-83621](https://cve.now/CVE-2026-83621.md): ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs (CVSS 8.1, ntopng)
- [CVE-2026-82412](https://cve.now/CVE-2026-82412.md): ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API (CVSS 8.8, ntopng)
- [CVE-2026-55563](https://cve.now/CVE-2026-55563.md): Feast: \`pull\_request\_target\` integration tests run untrusted fork code with production cloud secrets; the \`ok-to-test\` label guard is bypassable via label persistence on \`synchronize\` (CVSS 8.9, feast-dev feast)
- [CVE-2026-88978](https://cve.now/CVE-2026-88978.md): Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant\_id filter (CVSS 4.3, hatchet-dev hatchet · github.com/hatchet-dev/hatchet)
- [CVE-2026-84298](https://cve.now/CVE-2026-84298.md): Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher (CVSS 3.1, hatchet-dev hatchet · github.com/hatchet-dev/hatchet)
- [CVE-2026-61687](https://cve.now/CVE-2026-61687.md): hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState (CVSS 7.1, hatchet-dev hatchet · github.com/hatchet-dev/hatchet +1)
- [CVE-2026-63342](https://cve.now/CVE-2026-63342.md): Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check (CVSS 6.3, hatchet-dev hatchet · github.com/hatchet-dev/hatchet)
- [CVE-2026-61681](https://cve.now/CVE-2026-61681.md): Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler (CVSS 4.1, hatchet-dev hatchet · hatchet-dev/hatchet +1)
- [CVE-2026-85751](https://cve.now/CVE-2026-85751.md): Mailu: Authentication bypass in header-based proxy authentication via spoofable \`X-Forwarded-By\` trust (CVSS 9.8, Mailu)
- [CVE-2026-53940](https://cve.now/CVE-2026-53940.md): Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation (CVSS 8.8, conda)
- [CVE-2026-77165](https://cve.now/CVE-2026-77165.md): File owners were unable to unlock TYPE\_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of (CVSS 6.5, Nextcloud Server)
- [CVE-2026-77166](https://cve.now/CVE-2026-77166.md): The emoji field in the page emoji update endpoint does not properly validate user input. (CVSS 2.4, Nextcloud Collectives)
- [CVE-2026-71543](https://cve.now/CVE-2026-71543.md): OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters (CVSS 7.5, openbao · github.com/openbao/openbao)
- [CVE-2026-52742](https://cve.now/CVE-2026-52742.md): GoCD is vulnerable to historical server configuration API authorization bypass (CVSS 5.1, gocd)
- [CVE-2026-55870](https://cve.now/CVE-2026-55870.md): GoCD is vulnerable to credential exposure when admins insecurely configure material URLs (CVSS 2.3, gocd)
- [CVE-2026-55625](https://cve.now/CVE-2026-55625.md): GoCD is vulnerable to authorization bypass via material connection test APIs (CVSS 4.9, gocd)
- [CVE-2026-52740](https://cve.now/CVE-2026-52740.md): GoCD is vulnerable to pipeline template view API authorization bypass (CVSS 5.3, gocd)
- [CVE-2026-55060](https://cve.now/CVE-2026-55060.md): GoCD is vulnerable to authorization bypass via support process list API (CVSS 3.7, gocd)
- [CVE-2026-52741](https://cve.now/CVE-2026-52741.md): GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages (CVSS 7.5, gocd)
- [CVE-2026-68919](https://cve.now/CVE-2026-68919.md): GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages (CVSS 7.0, gocd)
- [CVE-2026-61628](https://cve.now/CVE-2026-61628.md): nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition (CVSS 8.1, lucasdillmann nginx-ignition · github.com/lucasdillmann/ngi…)
- [CVE-2026-94301](https://cve.now/CVE-2026-94301.md): Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 (CVSS 9.8, Apache Software Foundation Apache MINA)
- [CVE-2026-86473](https://cve.now/CVE-2026-86473.md): Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry (CVSS 9.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-75158](https://cve.now/CVE-2026-75158.md): Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-82355](https://cve.now/CVE-2026-82355.md): Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation (CVSS 4.2, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-93339](https://cve.now/CVE-2026-93339.md): Ditty \< 3.1.70 Stored XSS via Layout Tag Wrapper Attribute (CVSS 5.1, Metaphor Creations Ditty)
- [CVE-2026-52743](https://cve.now/CVE-2026-52743.md): GoCD before 26.1.0 is vulnerable to authorization bypass via job status API (CVSS 4.3, gocd)
- [CVE-2026-55074](https://cve.now/CVE-2026-55074.md): Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put\_file (host-side root mv) (CVSS 8.2, chofstede ansible\_jailexec · ansible-jailexec)
- [CVE-2026-55567](https://cve.now/CVE-2026-55567.md): BleachBit: Exploit File Delete to Escalate Privilege (CVSS 7.8, bleachbit)
- [CVE-2026-61629](https://cve.now/CVE-2026-61629.md): nginx ignition has ParseAcceptLanguage \`\_\` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware (CVSS 7.5, lucasdillmann nginx-ignition · github.com/lucasdillmann/ngi…)
- [CVE-2026-94184](https://cve.now/CVE-2026-94184.md): Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2026-61630](https://cve.now/CVE-2026-61630.md): nginx ignition has TOTP Reuse During Validity Window (CVSS 4.2, lucasdillmann nginx-ignition · github.com/lucasdillmann/ngi…)
- [CVE-2026-55071](https://cve.now/CVE-2026-55071.md): MCP-for-Stata: Stata Command Injection via Unsanitized \`package\` in \`ado\_package\_install\` (CVSS 8.4, SepineTam mcp-for-stata · stata-mcp)
- [CVE-2026-54584](https://cve.now/CVE-2026-54584.md): mport trusts environment-controlled temporary directories in privileged metadata extraction (CVSS 5.3, MidnightBSD mport)
- [CVE-2026-80110](https://cve.now/CVE-2026-80110.md): Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint (CVSS 8.1, Red Hat Enterprise Linux · Red Hat Certificate System)
- [CVE-2026-75939](https://cve.now/CVE-2026-75939.md): Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed (CVSS 7.4, Red Hat OpenShift Container Platform)
- [CVE-2026-94404](https://cve.now/CVE-2026-94404.md): MISP CSRF vulnerability allows unauthorized attribute modification (CVSS 7.1, MISP)
- [CVE-2026-88807](https://cve.now/CVE-2026-88807.md): libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow (CVSS 8.9, X.org libXrender)
- [CVE-2026-94387](https://cve.now/CVE-2026-94387.md): Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log (CVSS 5.1, Webkul Aureus ERP)
- [CVE-2025-71421](https://cve.now/CVE-2025-71421.md): UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent (CVSS 8.6, uvdesk core-framework · uvdesk community-skeleton)
- [CVE-2025-71420](https://cve.now/CVE-2025-71420.md): UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply (CVSS 5.3, uvdesk core-framework · uvdesk community-skeleton)
- [CVE-2025-71419](https://cve.now/CVE-2025-71419.md): UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer (CVSS 5.1, uvdesk core-framework · uvdesk community-skeleton)
- [CVE-2026-88806](https://cve.now/CVE-2026-88806.md): libX11 XkbGetMap Reply Heap-based Buffer Overflow (CVSS 7.5, x.org libX11)
- [CVE-2026-94401](https://cve.now/CVE-2026-94401.md): MISP Arbitrary Local File Read and SSRF via MISP Export Upload (CVSS 8.3, MISP)
- [CVE-2026-94394](https://cve.now/CVE-2026-94394.md): MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References (CVSS 6.3, MISP)
- [CVE-2026-94393](https://cve.now/CVE-2026-94393.md): MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport (CVSS 6.4, MISP)
- [CVE-2026-85220](https://cve.now/CVE-2026-85220.md): Denial-of-Service in the Thinkst Canary Redis service (CVSS 3.7, Thinkst Applied Research Canary)
- [CVE-2026-94382](https://cve.now/CVE-2026-94382.md): Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts (CVSS 2.3, henrygd beszel)
- [CVE-2026-94383](https://cve.now/CVE-2026-94383.md): MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension (CVSS 8.6, MISP)
- [CVE-2026-94216](https://cve.now/CVE-2026-94216.md): ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting (CVSS 5.3, ST Engineering iDirect iDX · ST Engineering iDirect Evo iDX)
- [CVE-2026-94381](https://cve.now/CVE-2026-94381.md): MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime (CVSS 8.7, MISP)
- [CVE-2026-94379](https://cve.now/CVE-2026-94379.md): MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP) (CVSS 6.9, MISP)
- [CVE-2026-94374](https://cve.now/CVE-2026-94374.md): MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports (CVSS 8.3, MISP)
- [CVE-2026-94373](https://cve.now/CVE-2026-94373.md): MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu (CVSS 6.3, MISP)
- [CVE-2026-94214](https://cve.now/CVE-2026-94214.md): ST Engineering iDirect iDX/Evo iDX Location Header redirect (CVSS 5.3, ST Engineering iDirect iDX · ST Engineering iDirect Evo iDX)
- [CVE-2026-84285](https://cve.now/CVE-2026-84285.md): OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 (CVSS 8.8, Dassault Systèmes Tuleap Enterprise Edition)
- [CVE-2026-94372](https://cve.now/CVE-2026-94372.md): Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index (CVSS 6.3, MISP)
- [CVE-2026-94211](https://cve.now/CVE-2026-94211.md): Hyve5 Leantime Project Dashboard show.blade.php cross site scripting (CVSS 4.8, Hyve5 Leantime)
- [CVE-2026-94368](https://cve.now/CVE-2026-94368.md): Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header (CVSS 7.1, Red Hat Openshift Data Foundation)
- [CVE-2026-89139](https://cve.now/CVE-2026-89139.md): Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host (CVSS 8.7, Temporal Technologies Temporal Server)
- [CVE-2026-87858](https://cve.now/CVE-2026-87858.md): Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization (CVSS 7.2, Temporal Technologies Temporal Server)
- [CVE-2026-65654](https://cve.now/CVE-2026-65654.md): temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip (CVSS 8.7, Temporal Technologies temporalio/ringpop-go)
- [CVE-2026-65653](https://cve.now/CVE-2026-65653.md): temporalio/tchannel-go zero-chunk call fragment causes process termination (CVSS 8.7, Temporal Technologies temporalio/tchannel-go)
- [CVE-2026-65652](https://cve.now/CVE-2026-65652.md): temporalio/tchannel-go malformed checksum type causes process termination (CVSS 8.7, Temporal Technologies temporalio/tchannel-go)
- [CVE-2026-65651](https://cve.now/CVE-2026-65651.md): temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal (CVSS 8.7, Temporal Technologies temporalio/sqlparser · Temporal Techn…)
- [CVE-2026-16651](https://cve.now/CVE-2026-16651.md): temporalio/sqlparser malformed MySQL version comments can cause a panic (CVSS 8.7, Temporal Technologies temporalio/sqlparser · Temporal Techn…)
- [CVE-2026-94210](https://cve.now/CVE-2026-94210.md): Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting (CVSS 5.1, Hyve5 Leantime)
- [CVE-2026-91867](https://cve.now/CVE-2026-91867.md): Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely (CVSS 4.3, Apache Software Foundation Apache Neethi)
- [CVE-2026-91866](https://cve.now/CVE-2026-91866.md): Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service (CVSS 7.5, Apache Software Foundation Apache Neethi)
- [CVE-2026-91865](https://cve.now/CVE-2026-91865.md): Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service (CVSS 7.5, Apache Software Foundation Apache Neethi)
- [CVE-2026-91864](https://cve.now/CVE-2026-91864.md): Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion (CVSS 7.5, Apache Software Foundation Apache Neethi)
- [CVE-2026-91863](https://cve.now/CVE-2026-91863.md): Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service (CVSS 7.5, Apache Software Foundation Apache Neethi)
- [CVE-2026-16652](https://cve.now/CVE-2026-16652.md): Temporal Server Schedule exclusion search can cause excessive CPU consumption (CVSS 7.1, Temporal Technologies Temporal Server)
- [CVE-2026-77021](https://cve.now/CVE-2026-77021.md): Missing decompression size limit in agent receiver allows memory exhaustion via push agent data (CVSS 5.3, Checkmk)
- [CVE-2026-92612](https://cve.now/CVE-2026-92612.md): In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as (CVSS 1.0, Eclipse Foundation Eclipse iceoryx™ · iceoryx2-bb-container)
- [CVE-2026-92574](https://cve.now/CVE-2026-92574.md): Cri-o: cri-o checkpoint restore bypasses destination security context (CVSS 8.8, cri-o · Red Hat Confidential Compute Attestation +2)
- [CVE-2026-91921](https://cve.now/CVE-2026-91921.md): Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform (CVSS 5.1, AI Chatbot Platform (SaaS) de 1millionbot.)
- [CVE-2026-94277](https://cve.now/CVE-2026-94277.md): Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name (CVSS 6.3, MISP)
- [CVE-2025-12999](https://cve.now/CVE-2025-12999.md): UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forward (CVSS 9.1, Eclipse Foundation Eclipse Open VSX)
- [CVE-2026-92400](https://cve.now/CVE-2026-92400.md): Payment Gateway for PayPal on WooCommerce \< 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion (CVSS 5.3, Payment Gateway for PayPal on WooCommerce)
- [CVE-2026-86802](https://cve.now/CVE-2026-86802.md): To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import (CVSS 3.7, To Do List Member)
- [CVE-2026-85113](https://cve.now/CVE-2026-85113.md): GiveWP \< 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name (CVSS 6.5, GiveWP)
- [CVE-2026-85010](https://cve.now/CVE-2026-85010.md): RestroPress \< 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons (CVSS 5.3, RestroPress)
- [CVE-2026-94152](https://cve.now/CVE-2026-94152.md): Omega Solution FBP Fulfillment by People User Profile API user authorization (CVSS 5.3, Omega Solution FBP Fulfillment by People)
- [CVE-2026-15801](https://cve.now/CVE-2026-15801.md): Cri-o: cri-o: insufficient validation during container checkpoint restore (CVSS 8.0, Red Hat OpenShift Container Platform)
- [CVE-2026-94151](https://cve.now/CVE-2026-94151.md): Omega Solution HRM OS Role Permission API permission missing authentication (CVSS 6.9, Omega Solution HRM OS)
- [CVE-2026-94150](https://cve.now/CVE-2026-94150.md): Omega Solution HRM OS SVG File Upload view cross site scripting (CVSS 4.8, Omega Solution HRM OS)
- [CVE-2026-94149](https://cve.now/CVE-2026-94149.md): Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection (CVSS 5.3, Omega Solution HRM OS)
- [CVE-2026-47321](https://cve.now/CVE-2026-47321.md): Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate (CVSS 7.5, Apache Software Foundation Apache MINA)
- [CVE-2026-94148](https://cve.now/CVE-2026-94148.md): ScadaBR Export Project Endpoint export\_project.htm EmportDwr.createExportJSON information disclosure (CVSS 6.9, ScadaBR)
- [CVE-2026-94146](https://cve.now/CVE-2026-94146.md): BioStar BIOS Update Utility IOCTL BSMEM64\_W10.sys sub\_110BC write-what-where (CVSS 9.3, BioStar BIOS Update Utility)
- [CVE-2026-94218](https://cve.now/CVE-2026-94218.md): Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint (CVSS 3.1, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-94217](https://cve.now/CVE-2026-94217.md): Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision (CVSS 3.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-94145](https://cve.now/CVE-2026-94145.md): xuxueli xxl-job Task Management JobInfoController.java cross site scripting (CVSS 5.1, xuxueli xxl-job)
- [CVE-2026-90860](https://cve.now/CVE-2026-90860.md): The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVie (CVSS 7.1, Canva)
- [CVE-2026-94144](https://cve.now/CVE-2026-94144.md): drogonframework drogon ORM Criteria.cc makeCriteria sql injection (CVSS 6.9, drogonframework drogon)
- [CVE-2026-94215](https://cve.now/CVE-2026-94215.md): Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check (CVSS 5.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-94213](https://cve.now/CVE-2026-94213.md): Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity (CVSS 4.9, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-82187](https://cve.now/CVE-2026-82187.md): WooCommerce Online Product Designer 1.7.0 - \< 2.15.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Web to Print Online Designer)
- [CVE-2026-94143](https://cve.now/CVE-2026-94143.md): drogonframework drogon ORM Mapper Mapper.h orderBy sql injection (CVSS 6.9, drogonframework drogon)
- [CVE-2026-94142](https://cve.now/CVE-2026-94142.md): BioStar Temperature Monitor Utility IOCTL BS\_HWMIO64\_W10.sys sub\_1105C write-what-where (CVSS 9.3, BioStar Temperature Monitor Utility)
- [CVE-2026-94139](https://cve.now/CVE-2026-94139.md): Chengdu Feiyuxing Technology Feiyu Star Router Cookie send\_order.cgi command injection (CVSS 5.3, Chengdu Feiyuxing Technology Feiyu Star Router)
- [CVE-2026-94138](https://cve.now/CVE-2026-94138.md): Chengdu Feiyuxing Technology Feiyu Star Router send\_order.cgi command injection (CVSS 5.1, Chengdu Feiyuxing Technology Feiyu Star Router)
- [CVE-2026-94137](https://cve.now/CVE-2026-94137.md): Hangzhou Shunwang Technology shzh IRP\_MJ\_DEVICE\_CONTROL shdrv\_x64.sys sub\_180004AC0 denial of service (CVSS 4.8, Hangzhou Shunwang Technology shzh)
- [CVE-2026-94185](https://cve.now/CVE-2026-94185.md): nvm alias resolution follows \`..\` and discloses files outside $NVM\_DIR/alias (CVSS 5.5, nvm-sh nvm)
- [CVE-2026-94129](https://cve.now/CVE-2026-94129.md): BioStar VALKYRIE AURORA IOCTL BS\_RVSIO64.sys sub\_1105C write-what-where (CVSS 9.3, BioStar VALKYRIE AURORA)
- [CVE-2026-94128](https://cve.now/CVE-2026-94128.md): BioStar VIVID LED DJ IOCTL BS\_LED64.sys sub\_1105C write-what-where (CVSS 9.3, BioStar VIVID LED DJ)
- [CVE-2026-94110](https://cve.now/CVE-2026-94110.md): QCMS Content Detail Controllers.php self\_Tmp sql injection (CVSS 6.9, QCMS)
- [CVE-2026-94103](https://cve.now/CVE-2026-94103.md): RooCMS Frontend Rendering site\_pagePHP.php eval code injection (CVSS 5.1, RooCMS)
- [CVE-2026-94102](https://cve.now/CVE-2026-94102.md): WuzhiCMS Login index.php redirect (CVSS 5.3, WuzhiCMS)
- [CVE-2026-94101](https://cve.now/CVE-2026-94101.md): Netcore NBR200V2 routerd vlan\_load\_form\_uci buffer overflow (CVSS 9.4, Netcore NBR200V2)
- [CVE-2026-94100](https://cve.now/CVE-2026-94100.md): Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan\_config\_set\_vlan buffer overflow (CVSS 9.4, Netcore NBR200V2)
- [CVE-2026-94099](https://cve.now/CVE-2026-94099.md): Netcore NBR200V2 Backup Restore restore.cgi command injection (CVSS 9.4, Netcore NBR200V2)
- [CVE-2026-94098](https://cve.now/CVE-2026-94098.md): Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection (CVSS 9.4, Netcore NBR200V2)
- [CVE-2026-36467](https://cve.now/CVE-2026-36467.md): Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access (CVSS 7.2)
- [CVE-2026-36468](https://cve.now/CVE-2026-36468.md): Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL param (CVSS 6.1)
- [CVE-2026-36469](https://cve.now/CVE-2026-36469.md): CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload\_from\_inet (Media Manager's "Upload (CVSS 9.1)
- [CVE-2026-36470](https://cve.now/CVE-2026-36470.md): CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. (CVSS 5.8)
- [CVE-2026-36471](https://cve.now/CVE-2026-36471.md): Deserialization of Untrusted Data of the \_\_post\_data parameter in cn\_parse\_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbi (CVSS 5.8)
- [CVE-2026-36472](https://cve.now/CVE-2026-36472.md): CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.2)
- [CVE-2026-67827](https://cve.now/CVE-2026-67827.md): Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) (CVSS 9.8)
- [CVE-2026-78806](https://cve.now/CVE-2026-78806.md): An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive i (CVSS 5.5)
- [CVE-2026-78847](https://cve.now/CVE-2026-78847.md): An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter w (CVSS 9.8)
- [CVE-2026-79079](https://cve.now/CVE-2026-79079.md): An issue in CrossWire Xiphos \<= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu\_popup.c com (CVSS 7.8)
- [CVE-2026-79316](https://cve.now/CVE-2026-79316.md): An improper access control vulnerability exists in x-ui 0.3.2. (CVSS 7.6)
- [CVE-2026-79317](https://cve.now/CVE-2026-79317.md): A session invalidation flaw exists in x-ui 0.3.2. (CVSS 4.8)
- [CVE-2026-79318](https://cve.now/CVE-2026-79318.md): web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read\_file()/write\_file() (appl (CVSS 6.5)
- [CVE-2026-79319](https://cve.now/CVE-2026-79319.md): Stencil core 4.43.5 is vulnerable to Incorrect Access Control. (CVSS 5.3)
- [CVE-2026-79320](https://cve.now/CVE-2026-79320.md): Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. (CVSS 6.1)
- [CVE-2026-88402](https://cve.now/CVE-2026-88402.md): A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via inje (CVSS 9.8)
- [CVE-2026-88403](https://cve.now/CVE-2026-88403.md): A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resou (CVSS 6.5)
- [CVE-2026-88404](https://cve.now/CVE-2026-88404.md): A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of U (CVSS 9.8)
- [CVE-2026-88405](https://cve.now/CVE-2026-88405.md): A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of U (CVSS 9.8)
- [CVE-2026-88406](https://cve.now/CVE-2026-88406.md): FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the \_ValidateUnion\_Clauses function (/ast/ast\_valid (CVSS 7.5)
- [CVE-2026-88407](https://cve.now/CVE-2026-88407.md): An out-of-bounds read in the node\_token\_count/relation\_token\_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers (CVSS 7.5)
- [CVE-2026-88408](https://cve.now/CVE-2026-88408.md): FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the \_GetGroup() function (/ops/op\_aggregate.c). (CVSS 6.5)
- [CVE-2026-88409](https://cve.now/CVE-2026-88409.md): FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the \_Decode\_GrB\_Matrix function (/v19/decode\_matri (CVSS 8.8)
- [CVE-2026-88410](https://cve.now/CVE-2026-88410.md): The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the (CVSS 7.1)
- [CVE-2026-88411](https://cve.now/CVE-2026-88411.md): Improper error handling in the GRAPH.EFFECT component (/effects/effects\_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Ser (CVSS 7.5)
- [CVE-2026-88412](https://cve.now/CVE-2026-88412.md): An integer overflow in the \_BulkInsert\_ReadProperty component (/bulk\_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause (CVSS 5.3)
- [CVE-2026-88467](https://cve.now/CVE-2026-88467.md): CRMEB Knowledge-Paid System crmeb\_zzff\_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors (CVSS 6.2)
- [CVE-2026-88738](https://cve.now/CVE-2026-88738.md): Jazzware RT1000 Edge webUI v. (CVSS 8.8)
- [CVE-2026-88745](https://cve.now/CVE-2026-88745.md): EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. (CVSS 6.1)
- [CVE-2026-88746](https://cve.now/CVE-2026-88746.md): idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy\_deal.php. (CVSS 7.1)
- [CVE-2026-88756](https://cve.now/CVE-2026-88756.md): Pagekit CMS \<= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logi (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.