# CVEs published 2026-09-22

453 CVEs were published on September 22, 2026: 85 critical, 178 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2026-95833](https://cve.now/CVE-2026-95833.md): itsourcecode Leave Management System index.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-95830](https://cve.now/CVE-2026-95830.md): theRealSain Pixtream post\_upload.php unrestricted upload (CVSS 5.3, theRealSain Pixtream)
- [CVE-2026-95829](https://cve.now/CVE-2026-95829.md): TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection (CVSS 5.3, TDuckCloud tduck-platform)
- [CVE-2026-94367](https://cve.now/CVE-2026-94367.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. (CVSS 7.2, OpenEye Apex Network Video Recorder)
- [CVE-2026-92930](https://cve.now/CVE-2026-92930.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device (CVSS 6.2, OpenEye Apex Network Video Recorder)
- [CVE-2026-92929](https://cve.now/CVE-2026-92929.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determini (CVSS 5.3, OpenEye Apex Network Video Recorder)
- [CVE-2026-92928](https://cve.now/CVE-2026-92928.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential th (CVSS 6.5, OpenEye Apex Network Video Recorder)
- [CVE-2026-61685](https://cve.now/CVE-2026-61685.md): ReactPress has SQL injection via dynamic column names in TypeORM query builders (CVSS 7.5, fecommunity reactpress · @fecommunity/reactpress)
- [CVE-2026-57576](https://cve.now/CVE-2026-57576.md): plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length (CVSS 6.5, plone.app.dexterity · plone.app.contenttypes +1)
- [CVE-2026-95828](https://cve.now/CVE-2026-95828.md): Mstfakts College-Management-System Authentication server.php session\_start session fixiation (CVSS 5.3, Mstfakts College-Management-System)
- [CVE-2026-95820](https://cve.now/CVE-2026-95820.md): anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload (CVSS 5.3, anirbandutta9 College-Notes-Gallery)
- [CVE-2026-18176](https://cve.now/CVE-2026-18176.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18173](https://cve.now/CVE-2026-18173.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 3.7, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18172](https://cve.now/CVE-2026-18172.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18169](https://cve.now/CVE-2026-18169.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.9, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18170](https://cve.now/CVE-2026-18170.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18163](https://cve.now/CVE-2026-18163.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18162](https://cve.now/CVE-2026-18162.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18161](https://cve.now/CVE-2026-18161.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 4.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18156](https://cve.now/CVE-2026-18156.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18154](https://cve.now/CVE-2026-18154.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.0, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18153](https://cve.now/CVE-2026-18153.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 5.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18152](https://cve.now/CVE-2026-18152.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18137](https://cve.now/CVE-2026-18137.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18134](https://cve.now/CVE-2026-18134.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-95819](https://cve.now/CVE-2026-95819.md): anirbandutta9 College-Notes-Gallery login.php sql injection (CVSS 6.9, anirbandutta9 College-Notes-Gallery)
- [CVE-2026-18133](https://cve.now/CVE-2026-18133.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 5.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-19202](https://cve.now/CVE-2026-19202.md): Token Cache Reuse in mcp-toolbox-sdk-python (CVSS 9.1, Google mcp-toolbox-sdk-python)
- [CVE-2026-18132](https://cve.now/CVE-2026-18132.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18131](https://cve.now/CVE-2026-18131.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.2, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18124](https://cve.now/CVE-2026-18124.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18123](https://cve.now/CVE-2026-18123.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.6, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18114](https://cve.now/CVE-2026-18114.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18095](https://cve.now/CVE-2026-18095.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18074](https://cve.now/CVE-2026-18074.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.2, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18066](https://cve.now/CVE-2026-18066.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.9, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17647](https://cve.now/CVE-2026-17647.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17646](https://cve.now/CVE-2026-17646.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17645](https://cve.now/CVE-2026-17645.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17644](https://cve.now/CVE-2026-17644.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17643](https://cve.now/CVE-2026-17643.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17637](https://cve.now/CVE-2026-17637.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17636](https://cve.now/CVE-2026-17636.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17635](https://cve.now/CVE-2026-17635.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17620](https://cve.now/CVE-2026-17620.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 5.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17618](https://cve.now/CVE-2026-17618.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17472](https://cve.now/CVE-2026-17472.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 9.6, IBM Concert)
- [CVE-2026-17465](https://cve.now/CVE-2026-17465.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.5, IBM Concert)
- [CVE-2026-17102](https://cve.now/CVE-2026-17102.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16672](https://cve.now/CVE-2026-16672.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16469](https://cve.now/CVE-2026-16469.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16468](https://cve.now/CVE-2026-16468.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16426](https://cve.now/CVE-2026-16426.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.5, IBM Concert)
- [CVE-2026-16346](https://cve.now/CVE-2026-16346.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 9.9, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-15915](https://cve.now/CVE-2026-15915.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.2, IBM Concert)
- [CVE-2025-12767](https://cve.now/CVE-2025-12767.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.3, IBM Concert)
- [CVE-2025-36084](https://cve.now/CVE-2025-36084.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.9, IBM Concert)
- [CVE-2026-75101](https://cve.now/CVE-2026-75101.md): Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision (CVSS 6.0, GitHub Enterprise Server)
- [CVE-2026-77912](https://cve.now/CVE-2026-77912.md): Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline (CVSS 7.4, GitHub Enterprise Server)
- [CVE-2026-77987](https://cve.now/CVE-2026-77987.md): GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery (CVSS 9.3, GitHub Enterprise Server)
- [CVE-2026-88020](https://cve.now/CVE-2026-88020.md): Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3 (CVSS 6.1, Autonomy Logic OpenPLC Runtime)
- [CVE-2026-96260](https://cve.now/CVE-2026-96260.md): Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user (CVSS 6.5, Mattermost)
- [CVE-2026-96259](https://cve.now/CVE-2026-96259.md): Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator (CVSS 5.5, Mattermost)
- [CVE-2026-96269](https://cve.now/CVE-2026-96269.md): GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affect (CVSS 7.5, GNU Emacs)
- [CVE-2026-77426](https://cve.now/CVE-2026-77426.md): Unleash: Missing await on permission check + cross-project IDOR in admin API (CVSS 7.1, unleash · unleash-server)
- [CVE-2026-67615](https://cve.now/CVE-2026-67615.md): openEQUELLA \< 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker (CVSS 8.7, Apereo Foundation openEQUELLA)
- [CVE-2026-77425](https://cve.now/CVE-2026-77425.md): Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log (CVSS 4.3, unleash · unleash-server)
- [CVE-2026-91018](https://cve.now/CVE-2026-91018.md): Double Free in lwIP (lightweight IP) (CVSS 8.8, lwIP API)
- [CVE-2026-76910](https://cve.now/CVE-2026-76910.md): Unleash: Clone-feature lets a user copy a feature from a project they cannot read (CVSS 5.3, unleash · unleash-server)
- [CVE-2026-95815](https://cve.now/CVE-2026-95815.md): OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging (CVSS 7.2, OpenClaw iOS)
- [CVE-2026-95814](https://cve.now/CVE-2026-95814.md): Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check (CVSS 8.6, dani-garcia vaultwarden)
- [CVE-2026-95813](https://cve.now/CVE-2026-95813.md): e621ng before 26.09.16 Open Redirect via URL Parameters (CVSS 5.3, e621ng)
- [CVE-2026-95812](https://cve.now/CVE-2026-95812.md): ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters (CVSS 5.3, MacWarrior clipbucket-v5)
- [CVE-2026-76909](https://cve.now/CVE-2026-76909.md): Unleash: CR-approval email renders user-controlled raw HTML (CVSS 2.1, unleash · unleash-server)
- [CVE-2026-62364](https://cve.now/CVE-2026-62364.md): wlc may disclose API tokens to project-configured URLs (CVSS 2.3, WeblateOrg wlc · wlc)
- [CVE-2026-94450](https://cve.now/CVE-2026-94450.md): Potential denial of service when configured to send Retry packets in s2n-quic (CVSS 7.5, AWS s2n-quic)
- [CVE-2026-79767](https://cve.now/CVE-2026-79767.md): Gardener: Authorization Bypass via Group Subject Injection (CVSS 5.5, gardener · github.com/gardener/gardener +1)
- [CVE-2026-61570](https://cve.now/CVE-2026-61570.md): MPXJ: XXE Vulnerability in MerlinReader (CVSS 7.5, joniles mpxj · net.sf.mpxj:mpxj +5)
- [CVE-2026-65829](https://cve.now/CVE-2026-65829.md): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (CVSS 5.3, joniles mpxj · MPXJ.Net +5)
- [CVE-2026-77322](https://cve.now/CVE-2026-77322.md): SIPGO: DoS via unvalidated WebSocket frame length (CVSS 7.5, emiago sipgo · github.com/emiago/sipgo)
- [CVE-2026-58268](https://cve.now/CVE-2026-58268.md): SIPGO: DoS via unvalidated Content-Length in the stream parser (CVSS 7.5, emiago sipgo · github.com/emiago/sipgo)
- [CVE-2026-87121](https://cve.now/CVE-2026-87121.md): Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application (CVSS 9.8, lwIP TCP/IP Stack MQTT)
- [CVE-2026-83805](https://cve.now/CVE-2026-83805.md): Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs (CVSS 6.4, nautobot)
- [CVE-2026-83801](https://cve.now/CVE-2026-83801.md): Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text (CVSS 5.4, nautobot)
- [CVE-2026-63104](https://cve.now/CVE-2026-63104.md): Kaneo 2.3.12 \< 2.12.2 Missing Authorization via Bulk Task Endpoint (CVSS 7.2, usekaneo kaneo)
- [CVE-2026-47116](https://cve.now/CVE-2026-47116.md): LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH (CVSS 9.2, LTSecurity LTK3500SF)
- [CVE-2026-94574](https://cve.now/CVE-2026-94574.md): CVE-2026-94574 (CVSS 7.8, GNU Wget (Windows Builds) Wget)
- [CVE-2026-89281](https://cve.now/CVE-2026-89281.md): CVE-2026-89281 (CVSS 8.4, Apache HTTP Server Project Apache Lounge Windows)
- [CVE-2026-89282](https://cve.now/CVE-2026-89282.md): CVE-2026-89282 (CVSS 9.1, Apache HTTP Server Project Apache Lounge Windows)
- [CVE-2026-62985](https://cve.now/CVE-2026-62985.md): request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process (CVSS 7.5, azu request-filtering-agent · request-filtering-agent)
- [CVE-2026-28325](https://cve.now/CVE-2026-28325.md): SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability (CVSS 8.8, SolarWinds Observability Self-Hosted)
- [CVE-2026-76717](https://cve.now/CVE-2026-76717.md): Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 5.3, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76716](https://cve.now/CVE-2026-76716.md): Unauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE) (CVSS 5.3, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76715](https://cve.now/CVE-2026-76715.md): Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.1, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76714](https://cve.now/CVE-2026-76714.md): Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.2, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76713](https://cve.now/CVE-2026-76713.md): Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.2, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76712](https://cve.now/CVE-2026-76712.md): Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.3, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76711](https://cve.now/CVE-2026-76711.md): Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.5, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76710](https://cve.now/CVE-2026-76710.md): Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.5, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76709](https://cve.now/CVE-2026-76709.md): Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 9.8, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76708](https://cve.now/CVE-2026-76708.md): Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 9.8, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-59991](https://cve.now/CVE-2026-59991.md): psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry (CVSS 7.5, psd-tools)
- [CVE-2026-28324](https://cve.now/CVE-2026-28324.md): SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (CVSS 9.8, SolarWinds Observability Self-Hosted)
- [CVE-2026-63628](https://cve.now/CVE-2026-63628.md): mppx: Gas Draining with access list (CVSS 6.9, wevm mppx · mppx)
- [CVE-2026-63627](https://cve.now/CVE-2026-63627.md): mppx: Gas Draining with padding (CVSS 6.9, wevm mppx · mppx)
- [CVE-2026-91129](https://cve.now/CVE-2026-91129.md): Home Assistant: mDNS Server-Side Request Forgery (CVSS 5.4, home-assistant core · homeassistant)
- [CVE-2026-91130](https://cve.now/CVE-2026-91130.md): Home Assistant: XSS in Statistics Graph Card (CVSS 9.3, home-assistant core · homeassistant)
- [CVE-2026-57149](https://cve.now/CVE-2026-57149.md): plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection (CVSS 9.9, plone.app.portlets · plone-app-portlets)
- [CVE-2026-63386](https://cve.now/CVE-2026-63386.md): js-toml: Uncontrolled recursion in \`load()\` causes \`RangeError\` (stack exhaustion) on deeply nested input (CVSS 5.3, sunnyadn js-toml)
- [CVE-2026-77399](https://cve.now/CVE-2026-77399.md): icalendar: Denial of service via unbounded VALARM REPEAT expansion (CVSS 6.5, collective icalendar)
- [CVE-2026-84395](https://cve.now/CVE-2026-84395.md): Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 7.1, Adobe Premiere)
- [CVE-2026-83963](https://cve.now/CVE-2026-83963.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-81998](https://cve.now/CVE-2026-81998.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-83962](https://cve.now/CVE-2026-83962.md): Substance3D - Modeler | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-79906](https://cve.now/CVE-2026-79906.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-94462](https://cve.now/CVE-2026-94462.md): Spree: Broken Access Control in \`PATCH /api/v3/store/carts/:id/associate\` (IDOR) (CVSS 7.1, spree · spree\_api)
- [CVE-2026-75743](https://cve.now/CVE-2026-75743.md): Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352) (CVSS 7.1, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-75745](https://cve.now/CVE-2026-75745.md): Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-82000](https://cve.now/CVE-2026-82000.md): Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.6, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-75744](https://cve.now/CVE-2026-75744.md): Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-81995](https://cve.now/CVE-2026-81995.md): Adobe Experience Manager Forms JEE | Improper Input Validation (CWE-20) (CVSS 9.1, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-81999](https://cve.now/CVE-2026-81999.md): Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 8.7, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-75689](https://cve.now/CVE-2026-75689.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-83964](https://cve.now/CVE-2026-83964.md): Adobe Connect | Improper Certificate Validation (CWE-295) (CVSS 6.2, Adobe Connect)
- [CVE-2026-34689](https://cve.now/CVE-2026-34689.md): Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 8.6, Adobe Connect)
- [CVE-2026-75686](https://cve.now/CVE-2026-75686.md): Adobe Connect | Improper Input Validation (CWE-20) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75682](https://cve.now/CVE-2026-75682.md): Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.9, Adobe Connect)
- [CVE-2026-48361](https://cve.now/CVE-2026-48361.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2026-75698](https://cve.now/CVE-2026-75698.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75684](https://cve.now/CVE-2026-75684.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75697](https://cve.now/CVE-2026-75697.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75658](https://cve.now/CVE-2026-75658.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75656](https://cve.now/CVE-2026-75656.md): Bridge | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Bridge)
- [CVE-2026-75649](https://cve.now/CVE-2026-75649.md): Bridge | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75676](https://cve.now/CVE-2026-75676.md): Bridge | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75655](https://cve.now/CVE-2026-75655.md): Bridge | Uncontrolled Recursion (CWE-674) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75665](https://cve.now/CVE-2026-75665.md): Bridge | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75663](https://cve.now/CVE-2026-75663.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-77246](https://cve.now/CVE-2026-77246.md): MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path (CVSS 7.4, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-75632](https://cve.now/CVE-2026-75632.md): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-75634](https://cve.now/CVE-2026-75634.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 4.3, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-75633](https://cve.now/CVE-2026-75633.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 5.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-19480](https://cve.now/CVE-2026-19480.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-89277](https://cve.now/CVE-2026-89277.md): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (CVSS 5.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-75638](https://cve.now/CVE-2026-75638.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 6.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-76194](https://cve.now/CVE-2026-76194.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 4.3, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-77248](https://cve.now/CVE-2026-77248.md): MCP Atlassian: Unauthenticated arbitrary local file read via upload\_attachment file\_path, chained with missing auth on streamable-http transport (CVSS 8.6, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95862](https://cve.now/CVE-2026-95862.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77256](https://cve.now/CVE-2026-77256.md): MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask (CVSS 8.3, sooperset mcp-atlassian)
- [CVE-2026-95861](https://cve.now/CVE-2026-95861.md): A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77249](https://cve.now/CVE-2026-77249.md): MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup (CVSS 5.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77259](https://cve.now/CVE-2026-77259.md): MCP Atlassian: Arbitrary file read via confluence\_upload\_attachment allows exfiltration of server credentials (CVSS 7.7, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77268](https://cve.now/CVE-2026-77268.md): MCP Atlassian: Insecure File Permissions on OAuth Token Storage (CVSS 5.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77558](https://cve.now/CVE-2026-77558.md): A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77556](https://cve.now/CVE-2026-77556.md): A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77555](https://cve.now/CVE-2026-77555.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77544](https://cve.now/CVE-2026-77544.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77247](https://cve.now/CVE-2026-77247.md): MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file\_path parameters (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-84396](https://cve.now/CVE-2026-84396.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2026-76192](https://cve.now/CVE-2026-76192.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2026-77272](https://cve.now/CVE-2026-77272.md): MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler (CVSS 5.4, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77269](https://cve.now/CVE-2026-77269.md): MCP Atlassian: Path traversal in upload\_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825) (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77266](https://cve.now/CVE-2026-77266.md): MCP Atlassian: Path traversal in upload\_attachment allows arbitrary file read and exfiltration via MCP tool call (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77255](https://cve.now/CVE-2026-77255.md): MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update\_issue (CVSS 8.6, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95831](https://cve.now/CVE-2026-95831.md): Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL (CVSS 7.8, Crypt-SelfCertificate)
- [CVE-2026-77262](https://cve.now/CVE-2026-77262.md): MCP Atlassian: Path Traversal / Arbitrary File Read in confluence\_upload\_attachment MCP tool (incomplete fix of CVE-2026-27825) (CVSS 8.6, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77254](https://cve.now/CVE-2026-77254.md): MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials (CVSS 9.1, sooperset mcp-atlassian)
- [CVE-2026-77253](https://cve.now/CVE-2026-77253.md): MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files (CVSS 7.1, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77257](https://cve.now/CVE-2026-77257.md): MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77261](https://cve.now/CVE-2026-77261.md): MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches (CVSS 7.1, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77260](https://cve.now/CVE-2026-77260.md): MCP Atlassian: Arbitrary local file READ via unconstrained file\_path in upload\_attachment (Confluence + Jira) (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77271](https://cve.now/CVE-2026-77271.md): MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825) (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95660](https://cve.now/CVE-2026-95660.md): Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection (CVSS 5.3, Moonshot AI Kimi Code)
- [CVE-2026-77242](https://cve.now/CVE-2026-77242.md): MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned) (CVSS 7.5, sooperset mcp-atlassian)
- [CVE-2026-77243](https://cve.now/CVE-2026-77243.md): MCP Atlassian: ENABLED\_TOOLS / Toolset authorization bypass (CVSS 8.8, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77251](https://cve.now/CVE-2026-77251.md): MCP Atlassian: JIRA\_PROJECTS\_FILTER / CONFLUENCE\_SPACES\_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud) (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-43643](https://cve.now/CVE-2026-43643.md): Softaculous Virtualizor Authorization Bypass via Billing Module Handler (CVSS 8.7, Softaculous Virtualizor)
- [CVE-2026-77252](https://cve.now/CVE-2026-77252.md): MCP Atlassian: JIRA\_PROJECTS\_FILTER and CONFLUENCE\_SPACES\_FILTER can be bypassed in search tools (CVSS 6.5, sooperset mcp-atlassian)
- [CVE-2026-43642](https://cve.now/CVE-2026-43642.md): Softaculous Virtualizor PHP Object Injection via Billing Module Handler (CVSS 9.2, Softaculous Virtualizor)
- [CVE-2026-77267](https://cve.now/CVE-2026-77267.md): mcp-atlassian has an incomplete SSRF remediation (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-43641](https://cve.now/CVE-2026-43641.md): Softaculous Virtualizor OS Command Injection via Billing Module Handler (CVSS 9.3, Softaculous Virtualizor)
- [CVE-2026-77250](https://cve.now/CVE-2026-77250.md): MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions (CVSS 6.1, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-18626](https://cve.now/CVE-2026-18626.md): Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. (CVSS 6.8, RTI Connext Professional)
- [CVE-2026-18462](https://cve.now/CVE-2026-18462.md): Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation. (CVSS 7.3, RTI Connext Professional)
- [CVE-2026-18461](https://cve.now/CVE-2026-18461.md): Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. (CVSS 9.2, RTI Connext Professional)
- [CVE-2026-18460](https://cve.now/CVE-2026-18460.md): Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (CVSS 6.9, RTI Connext Professional)
- [CVE-2026-18459](https://cve.now/CVE-2026-18459.md): Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. (CVSS 8.7, RTI Connext Professional)
- [CVE-2026-18458](https://cve.now/CVE-2026-18458.md): Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. (CVSS 6.8, RTI Connext Professional)
- [CVE-2026-18457](https://cve.now/CVE-2026-18457.md): Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (CVSS 8.3, RTI Connext Professional)
- [CVE-2026-11389](https://cve.now/CVE-2026-11389.md): Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. (CVSS 6.8, RTI Connext Professional)
- [CVE-2026-11388](https://cve.now/CVE-2026-11388.md): Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. (CVSS 6.9, RTI Connext Professional)
- [CVE-2026-8849](https://cve.now/CVE-2026-8849.md): Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. (CVSS 7.7, RTI Connext Professional)
- [CVE-2026-7866](https://cve.now/CVE-2026-7866.md): Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (CVSS 10.0, RTI Connext Professional)
- [CVE-2026-77244](https://cve.now/CVE-2026-77244.md): \[mcp-atlassian\] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token (CVSS 10.0, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77265](https://cve.now/CVE-2026-77265.md): MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow (CVSS 5.9, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77270](https://cve.now/CVE-2026-77270.md): MCP Atlassian: Arbitrary File Read via Upload Attachment Tools (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95657](https://cve.now/CVE-2026-95657.md): dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting (CVSS 5.1, dgtlmoon Changedetection.io)
- [CVE-2026-75703](https://cve.now/CVE-2026-75703.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-84412](https://cve.now/CVE-2026-84412.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-89276](https://cve.now/CVE-2026-89276.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-83660](https://cve.now/CVE-2026-83660.md): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-82013](https://cve.now/CVE-2026-82013.md): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-82003](https://cve.now/CVE-2026-82003.md): Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20) (CVSS 8.5, Adobe Campaign Classic)
- [CVE-2026-82009](https://cve.now/CVE-2026-82009.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.1, Adobe Campaign Classic)
- [CVE-2026-75721](https://cve.now/CVE-2026-75721.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-75723](https://cve.now/CVE-2026-75723.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-75699](https://cve.now/CVE-2026-75699.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-73369](https://cve.now/CVE-2026-73369.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-82011](https://cve.now/CVE-2026-82011.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.1, Adobe Campaign Classic)
- [CVE-2026-82443](https://cve.now/CVE-2026-82443.md): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.6, Adobe Campaign Classic)
- [CVE-2026-82008](https://cve.now/CVE-2026-82008.md): Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-89275](https://cve.now/CVE-2026-89275.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-75728](https://cve.now/CVE-2026-75728.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 9.1, Adobe Campaign Classic)
- [CVE-2026-82010](https://cve.now/CVE-2026-82010.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-77258](https://cve.now/CVE-2026-77258.md): MCP Atlassian: Arbitrary file read/exfiltration via upload\_attachment missing validate\_safe\_path() (CVSS 7.7, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77274](https://cve.now/CVE-2026-77274.md): MCP Atlassian: SSRF Protection Bypass (CVSS 8.8, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95624](https://cve.now/CVE-2026-95624.md): Tauri framework v2 malicious downgrade via allow\_downgrades from frontend code (CVSS 6.8, tauri-plugin-updater)
- [CVE-2026-95656](https://cve.now/CVE-2026-95656.md): dgtlmoon changedetection.io Preview Endpoint \_\_init\_\_.py add\_watch\_ui\_snapshot server-side request forgery (CVSS 6.9, dgtlmoon changedetection.io)
- [CVE-2026-85995](https://cve.now/CVE-2026-85995.md): Notepad++: Authenticode verification bypass allows modified updater execution (CVSS 7.3, notepad-plus-plus)
- [CVE-2026-86056](https://cve.now/CVE-2026-86056.md): Notepad++: Null pointer dereference in NPPM\_SAVESESSION message handler causes crash (DoS) (CVSS 5.5, notepad-plus-plus)
- [CVE-2026-77605](https://cve.now/CVE-2026-77605.md): Notepad++ “Run by system” executes \*.txt.cmd when user selected \*.txt (target confusion → command execution) (CVSS 7.8, notepad-plus-plus)
- [CVE-2026-86054](https://cve.now/CVE-2026-86054.md): Notepad++: Stack Buffer Overflow in \`NppParameters::writeSession\` via overlong session path (CVSS 7.8, notepad-plus-plus)
- [CVE-2026-85288](https://cve.now/CVE-2026-85288.md): Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog (CVSS 6.7, notepad-plus-plus)
- [CVE-2026-85279](https://cve.now/CVE-2026-85279.md): Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value (CVSS 8.6, notepad-plus-plus)
- [CVE-2026-93345](https://cve.now/CVE-2026-93345.md): MikroTik RouterOS \< 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI (CVSS 8.7, MikroTik RouterOS)
- [CVE-2026-94384](https://cve.now/CVE-2026-94384.md): Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda (CVSS 8.1, amazon-connect-salesforce-lambda)
- [CVE-2026-83597](https://cve.now/CVE-2026-83597.md): Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution (CVSS 7.0, netdata)
- [CVE-2026-83600](https://cve.now/CVE-2026-83600.md): Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent (CVSS 6.5, netdata)
- [CVE-2026-83598](https://cve.now/CVE-2026-83598.md): Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair (CVSS 7.8, netdata)
- [CVE-2026-83603](https://cve.now/CVE-2026-83603.md): Netdata: Local Root via ndsudo Arbitrary socket\_path → fail2ban-client Pickle RCE (CVSS 8.4, netdata)
- [CVE-2026-83601](https://cve.now/CVE-2026-83601.md): Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write (CVSS 6.5, netdata)
- [CVE-2026-83602](https://cve.now/CVE-2026-83602.md): Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP\_ACL\_NOCHECK (CVSS 6.5, netdata)
- [CVE-2026-83599](https://cve.now/CVE-2026-83599.md): Netdata: WebSocket Decompression Bomb (CVSS 7.5, netdata)
- [CVE-2026-84301](https://cve.now/CVE-2026-84301.md): FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests (CVSS 6.3, labring FastGPT)
- [CVE-2026-95818](https://cve.now/CVE-2026-95818.md): AT\_SECURE program buffer overflow via $ORIGIN processing (CVSS 3.6, The GNU C Library glibc)
- [CVE-2026-76805](https://cve.now/CVE-2026-76805.md): Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode (CVSS 5.3, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-76802](https://cve.now/CVE-2026-76802.md): Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass (CVSS 4.7, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-87902](https://cve.now/CVE-2026-87902.md): An unauthenticated attacker can make \`get\_page\_template()\` page-template resolution include a chosen readable local \`.php\` file outside the (CVSS 8.1, KEV, WordPress)
- [CVE-2026-76804](https://cve.now/CVE-2026-76804.md): Nuclei: Local File Read via Workflow File-Protocol Gate Bypass (CVSS 5.5, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-76803](https://cve.now/CVE-2026-76803.md): Nuclei: Local File Read via MySQL Client Sandbox Bypass (CVSS 5.3, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-83803](https://cve.now/CVE-2026-83803.md): Sentry: Unsafe pickle deserialization in Relocation Feature (CVSS 7.7, getsentry sentry)
- [CVE-2026-86062](https://cve.now/CVE-2026-86062.md): LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content (CVSS 6.1, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-85740](https://cve.now/CVE-2026-85740.md): LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard (CVSS 7.1, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-85734](https://cve.now/CVE-2026-85734.md): LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks (CVSS 9.1, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-94455](https://cve.now/CVE-2026-94455.md): Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key (CVSS 7.1, GitroomHQ postiz-app)
- [CVE-2026-85725](https://cve.now/CVE-2026-85725.md): LightRAG: Plaintext Passwords Compared Without Constant-Time Function (CVSS 5.9, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-85709](https://cve.now/CVE-2026-85709.md): LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses (CVSS 5.3, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-86059](https://cve.now/CVE-2026-86059.md): Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one (CVSS 9.6, dokploy)
- [CVE-2026-94456](https://cve.now/CVE-2026-94456.md): Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys (CVSS 9.1, GitroomHQ postiz-app)
- [CVE-2026-56682](https://cve.now/CVE-2026-56682.md): 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header (CVSS 5.3, decolua 9router · 9router)
- [CVE-2026-56681](https://cve.now/CVE-2026-56681.md): 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header (CVSS 7.3, decolua 9router · 9router)
- [CVE-2026-86805](https://cve.now/CVE-2026-86805.md): AT\_SECURE programs may load attacker-controlled code via $ORIGIN (CVSS 6.3, The GNU C Library glibc)
- [CVE-2026-86698](https://cve.now/CVE-2026-86698.md): Refresh tokens accepted as private repository credentials at the CDN (CVSS 2.3, hexpm)
- [CVE-2026-75517](https://cve.now/CVE-2026-75517.md): Novu: Cross-Environment Integration Manipulation (IDOR) (CVSS 6.5, novuhq novu · @novu api-service)
- [CVE-2026-90462](https://cve.now/CVE-2026-90462.md): Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization (CVSS 5.4, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-75511](https://cve.now/CVE-2026-75511.md): Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs (CVSS 5.3, novuhq novu · @novu api-service)
- [CVE-2026-75510](https://cve.now/CVE-2026-75510.md): Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme (CVSS 5.1, novuhq novu · @novu/js)
- [CVE-2026-94640](https://cve.now/CVE-2026-94640.md): Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-70410](https://cve.now/CVE-2026-70410.md): Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins (CVSS 8.8, Apache Software Foundation Apache Calcite Avatica)
- [CVE-2026-88010](https://cve.now/CVE-2026-88010.md): Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle (CVSS 6.3, traefik · github.com/traefik/traefik)
- [CVE-2026-75608](https://cve.now/CVE-2026-75608.md): Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information (CVSS 7.7, blakeblackshear frigate)
- [CVE-2026-75607](https://cve.now/CVE-2026-75607.md): Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations (CVSS 8.1, blakeblackshear frigate)
- [CVE-2026-77637](https://cve.now/CVE-2026-77637.md): Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope (CVSS 3.8, cloudreve · github.com/cloudreve/Cloudreve +2)
- [CVE-2026-77633](https://cve.now/CVE-2026-77633.md): Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service (CVSS 7.1, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-79913](https://cve.now/CVE-2026-79913.md): Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses (CVSS 6.5, cloudreve · github.com/cloudreve/Cloudreve +2)
- [CVE-2026-95655](https://cve.now/CVE-2026-95655.md): Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel (CVSS 8.6, Webkul Aureus ERP)
- [CVE-2026-95654](https://cve.now/CVE-2026-95654.md): Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token (CVSS 9.1, David-Crty Databasement)
- [CVE-2026-95653](https://cve.now/CVE-2026-95653.md): Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token (CVSS 8.7, concretecms-community-store community\_store)
- [CVE-2026-80156](https://cve.now/CVE-2026-80156.md): Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-63374](https://cve.now/CVE-2026-63374.md): AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing (CVSS 9.3, agronholm anyio · anyio)
- [CVE-2026-80155](https://cve.now/CVE-2026-80155.md): Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation (CVSS 10.0, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80154](https://cve.now/CVE-2026-80154.md): Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass (CVSS 8.9, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80152](https://cve.now/CVE-2026-80152.md): Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-92706](https://cve.now/CVE-2026-92706.md): Dark Reader: Ability to request icon-like bitmap data from certain local web servers (CVSS 3.4, darkreader)
- [CVE-2026-80151](https://cve.now/CVE-2026-80151.md): Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80150](https://cve.now/CVE-2026-80150.md): Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter (CVSS 7.7, LANTRONIX SLC8000 · LANTRONIX EMG8500 +3)
- [CVE-2026-80149](https://cve.now/CVE-2026-80149.md): Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter (CVSS 7.7, LANTRONIX SLC8000 · LANTRONIX EMG8500 +3)
- [CVE-2026-80148](https://cve.now/CVE-2026-80148.md): Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation (CVSS 7.7, LANTRONIX SLC8000 · LANTRONIX EMG8500 +3)
- [CVE-2026-85055](https://cve.now/CVE-2026-85055.md): Twenty: Field-level read bypass (CVSS 7.1, twentyhq twenty)
- [CVE-2026-80147](https://cve.now/CVE-2026-80147.md): Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80146](https://cve.now/CVE-2026-80146.md): Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-77621](https://cve.now/CVE-2026-77621.md): Vector: Arbitrary file write in the file sink via templated path (path traversal). (CVSS 9.3, vectordotdev vector)
- [CVE-2026-80145](https://cve.now/CVE-2026-80145.md): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-77620](https://cve.now/CVE-2026-77620.md): Vector: Unauthenticated denial of service in the \`logstash\` source via nested compressed frames (stack exhaustion and decompression amplification). (CVSS 8.7, vectordotdev vector)
- [CVE-2026-80144](https://cve.now/CVE-2026-80144.md): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80143](https://cve.now/CVE-2026-80143.md): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-77619](https://cve.now/CVE-2026-77619.md): Vector: Unauthenticated denial of service in the \`logstash\` source via unbounded memory allocation. (CVSS 8.7, vectordotdev vector)
- [CVE-2026-81883](https://cve.now/CVE-2026-81883.md): radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode (CVSS 3.3, radareorg radare2)
- [CVE-2026-81885](https://cve.now/CVE-2026-81885.md): radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser (CVSS 5.5, radareorg radare2)
- [CVE-2026-81882](https://cve.now/CVE-2026-81882.md): radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser (CVSS 3.3, radareorg radare2)
- [CVE-2026-81886](https://cve.now/CVE-2026-81886.md): radare2: Uncontrolled memory allocation in radare2 dmp64 parser (CVSS 5.5, radareorg radare2)
- [CVE-2026-81884](https://cve.now/CVE-2026-81884.md): radare2: Heap out-of-bounds read in radare2 Mach-O LC\_DATA\_IN\_CODE parser (CVSS 2.5, radareorg radare2)
- [CVE-2026-81880](https://cve.now/CVE-2026-81880.md): radare2: Uncontrolled resource consumption in radare2 PEF loader (CVSS 5.5, radareorg radare2)
- [CVE-2026-95806](https://cve.now/CVE-2026-95806.md): MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths (CVSS 7.7, MISP)
- [CVE-2026-81879](https://cve.now/CVE-2026-81879.md): radare2: Heap out-of-bounds read in radare2 ELF PN\_XNUM handling (CVSS 5.5, radareorg radare2)
- [CVE-2026-81878](https://cve.now/CVE-2026-81878.md): radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser (CVSS 5.5, radareorg radare2)
- [CVE-2026-81881](https://cve.now/CVE-2026-81881.md): radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser (CVSS 3.3, radareorg radare2)
- [CVE-2026-95805](https://cve.now/CVE-2026-95805.md): MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction (CVSS 5.3, MISP)
- [CVE-2026-19915](https://cve.now/CVE-2026-19915.md): HP Support Assistant - Local Escalation of Privilege (CVSS 7.3, HP Support Assistant)
- [CVE-2026-95754](https://cve.now/CVE-2026-95754.md): MISP: Disabled-user check ineffective in pre-authentication TOTP login branch (CVSS 6.9, MISP)
- [CVE-2026-89407](https://cve.now/CVE-2026-89407.md): jackson-core: quadratic backtracking in NumberInput.PATTERN\_FLOAT via looksLikeValidNumber() enables ReDoS (CVSS 7.5, FasterXML jackson-core · com.fasterxml.jackson.core:jack… +1)
- [CVE-2026-95703](https://cve.now/CVE-2026-95703.md): MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp\_name (CVSS 5.1, MISP)
- [CVE-2026-95701](https://cve.now/CVE-2026-95701.md): MISP Path Traversal via Organization Name in Org-Statistics Logo Check (CVSS 5.1, MISP)
- [CVE-2026-95698](https://cve.now/CVE-2026-95698.md): MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name (CVSS 5.3, MISP)
- [CVE-2026-95697](https://cve.now/CVE-2026-95697.md): MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata (CVSS 5.3, MISP)
- [CVE-2026-95501](https://cve.now/CVE-2026-95501.md): mtrano APENCMS Template weasel.php eval code injection (CVSS 4.8, mtrano APENCMS)
- [CVE-2026-95693](https://cve.now/CVE-2026-95693.md): MISP Information Disclosure via Forged Upload Path (CVSS 5.3, MISP)
- [CVE-2026-94127](https://cve.now/CVE-2026-94127.md): BIG-IP APM OAuth vulnerability (CVSS 9.8, KEV, F5 BIG-IP)
- [CVE-2026-95500](https://cve.now/CVE-2026-95500.md): JosephChuks php-file-manager-with-code-editor Save codeEditor.php file\_put\_contents unrestricted upload (CVSS 6.9, JosephChuks php-file-manager-with-code-editor)
- [CVE-2026-94570](https://cve.now/CVE-2026-94570.md): CVE-2026-94570 (CVSS 5.9, SGLang)
- [CVE-2026-95685](https://cve.now/CVE-2026-95685.md): MISP Missing Authorization on replaceSuggestionInReport Event Report Action (CVSS 5.3, MISP)
- [CVE-2026-84388](https://cve.now/CVE-2026-84388.md): A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome (CVSS 9.1, Fortinet FortiPAM Chrome Extension)
- [CVE-2026-65112](https://cve.now/CVE-2026-65112.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. (CVSS 6.5, NVIDIA Infrastructure Controller)
- [CVE-2026-65118](https://cve.now/CVE-2026-65118.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. (CVSS 7.5, NVIDIA Infrastructure Controller)
- [CVE-2026-65117](https://cve.now/CVE-2026-65117.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. (CVSS 5.0, NVIDIA Infrastructure Controller)
- [CVE-2026-65115](https://cve.now/CVE-2026-65115.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. (CVSS 6.5, NVIDIA Infrastructure Controller)
- [CVE-2026-65114](https://cve.now/CVE-2026-65114.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical func (CVSS 8.3, NVIDIA Infrastructure Controller)
- [CVE-2026-65113](https://cve.now/CVE-2026-65113.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. (CVSS 9.8, NVIDIA Infrastructure Controller)
- [CVE-2026-65130](https://cve.now/CVE-2026-65130.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. (CVSS 8.0, NVIDIA Infrastructure Controller)
- [CVE-2026-65129](https://cve.now/CVE-2026-65129.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. (CVSS 6.7, NVIDIA Infrastructure Controller)
- [CVE-2026-65128](https://cve.now/CVE-2026-65128.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. (CVSS 8.8, NVIDIA Infrastructure Controller)
- [CVE-2026-65127](https://cve.now/CVE-2026-65127.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information d (CVSS 4.1, NVIDIA Infrastructure Controller)
- [CVE-2026-65126](https://cve.now/CVE-2026-65126.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workf (CVSS 5.0, NVIDIA Infrastructure Controller)
- [CVE-2026-65125](https://cve.now/CVE-2026-65125.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. (CVSS 6.6, NVIDIA Infrastructure Controller)
- [CVE-2026-65124](https://cve.now/CVE-2026-65124.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. (CVSS 5.9, NVIDIA Infrastructure Controller)
- [CVE-2026-65121](https://cve.now/CVE-2026-65121.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. (CVSS 8.2, NVIDIA Infrastructure Controller)
- [CVE-2026-93088](https://cve.now/CVE-2026-93088.md): CVE-2026-93088 (CVSS 9.8, SGLang)
- [CVE-2026-95683](https://cve.now/CVE-2026-95683.md): MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL (CVSS 5.3, MISP)
- [CVE-2026-65179](https://cve.now/CVE-2026-65179.md): NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pic (CVSS 8.8, NVIDIA NeMo Speech)
- [CVE-2026-65178](https://cve.now/CVE-2026-65178.md): NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model\_config.yaml can inject unsafe paramet (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-65111](https://cve.now/CVE-2026-65111.md): NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-24239](https://cve.now/CVE-2026-24239.md): NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-24267](https://cve.now/CVE-2026-24267.md): NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an atta (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-93344](https://cve.now/CVE-2026-93344.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_get\_page\_content AJAX (CVSS 7.1, WebWizards MarketKing)
- [CVE-2026-93343](https://cve.now/CVE-2026-93343.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_admin\_vendors\_ajax (CVSS 7.1, WebWizards MarketKing)
- [CVE-2026-95682](https://cve.now/CVE-2026-95682.md): MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View (CVSS 4.8, MISP)
- [CVE-2026-93342](https://cve.now/CVE-2026-93342.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_duplicate\_product AJAX (CVSS 5.3, WebWizards MarketKing)
- [CVE-2026-12718](https://cve.now/CVE-2026-12718.md): SQLi in Karel Electronics' KarelIPS (CVSS 9.8, Karel Electronic Industry and Trade KarelIPS)
- [CVE-2026-93341](https://cve.now/CVE-2026-93341.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_send\_refund AJAX (CVSS 5.3, WebWizards MarketKing)
- [CVE-2026-95679](https://cve.now/CVE-2026-95679.md): MISP Unauthenticated Blind SSRF via XML Body Processing (CVSS 6.9, MISP)
- [CVE-2026-95675](https://cve.now/CVE-2026-95675.md): D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface (CVSS 9.3, D-LINK DAP-1360)
- [CVE-2026-95499](https://cve.now/CVE-2026-95499.md): JosephChuks php-file-manager-with-code-editor filemanager.php move\_uploaded\_file unrestricted upload (CVSS 6.9, JosephChuks php-file-manager-with-code-editor)
- [CVE-2026-95674](https://cve.now/CVE-2026-95674.md): MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation (CVSS 5.3, MISP)
- [CVE-2026-95671](https://cve.now/CVE-2026-95671.md): MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add (CVSS 5.3, MISP)
- [CVE-2026-95667](https://cve.now/CVE-2026-95667.md): MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials (CVSS 6.9, MISP)
- [CVE-2026-95666](https://cve.now/CVE-2026-95666.md): Unbounded post ID array in the bulk reactions endpoint allows denial of service (CVSS 4.3, Mattermost)
- [CVE-2026-95665](https://cve.now/CVE-2026-95665.md): MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON (CVSS 5.1, MISP)
- [CVE-2026-95396](https://cve.now/CVE-2026-95396.md): sfturing hosp\_order Public Search Handlers HospitalController.java cross site scripting (CVSS 5.3, sfturing hosp\_order)
- [CVE-2026-93616](https://cve.now/CVE-2026-93616.md): Directory Traversal and File upload allows execution of arbitrary script on the Management Server (CVSS 9.8, KEV, checkpoint Quantum Security Management)
- [CVE-2026-95661](https://cve.now/CVE-2026-95661.md): MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List (CVSS 5.1, MISP)
- [CVE-2026-95619](https://cve.now/CVE-2026-95619.md): Gcc: libstdc++ integer overflow in \`new\` operator (CVSS 7.7, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-95659](https://cve.now/CVE-2026-95659.md): MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread (CVSS 4.8, MISP)
- [CVE-2026-95658](https://cve.now/CVE-2026-95658.md): MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules (CVSS 6.9, MISP)
- [CVE-2026-95273](https://cve.now/CVE-2026-95273.md): dgtlmoon changedetection.io visual\_selector\_data flask\_app.py static\_content path traversal (CVSS 5.3, dgtlmoon changedetection.io)
- [CVE-2026-95272](https://cve.now/CVE-2026-95272.md): dgtlmoon changedetection.io Screenshot flask\_app.py static\_content path traversal (CVSS 6.3, dgtlmoon changedetection.io)
- [CVE-2026-75791](https://cve.now/CVE-2026-75791.md): Authentication bypass vulnerability (CVSS 8.6, Zohocorp ManageEngine ADSelfService Plus)
- [CVE-2026-95271](https://cve.now/CVE-2026-95271.md): dgtlmoon changedetection.io Authentication Hook flask\_app.py check\_authentication improper authentication (CVSS 6.9, dgtlmoon changedetection.io)
- [CVE-2026-74849](https://cve.now/CVE-2026-74849.md): Remote code execution vulnerability (CVSS 9.8, Zohocorp ManageEngine ADSelfService Plus)
- [CVE-2026-87119](https://cve.now/CVE-2026-87119.md): mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed (CVSS 8.2, ZenHive mpp)
- [CVE-2026-89420](https://cve.now/CVE-2026-89420.md): Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free (CVSS 7.1, ZenHive mpp)
- [CVE-2026-95270](https://cve.now/CVE-2026-95270.md): dgtlmoon changedetection.io Hash Comparison flask\_app.py check\_password timing discrepancy (CVSS 6.3, dgtlmoon changedetection.io)
- [CVE-2026-63279](https://cve.now/CVE-2026-63279.md): Out of bounds read in PICT image import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63278](https://cve.now/CVE-2026-63278.md): Package URLs can be used to exfiltrate arbitrary INI file values and environment variables (CVSS 6.7, The Document Foundation LibreOffice)
- [CVE-2026-63276](https://cve.now/CVE-2026-63276.md): Stack buffer overflow in CFF to Type 1 font conversion (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63275](https://cve.now/CVE-2026-63275.md): Stack buffer overflow in CFF font hint handling (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63274](https://cve.now/CVE-2026-63274.md): Heap buffer overflow in PDF import stream handling (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63273](https://cve.now/CVE-2026-63273.md): Heap buffer overflow in PDF import encryption handling (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63272](https://cve.now/CVE-2026-63272.md): Heap buffer overflow in WMF text record import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-95623](https://cve.now/CVE-2026-95623.md): Tauri framework v2 SSRF Protection Bypass via HTTP Redirects (CVSS 5.6, tauri-plugin-http)
- [CVE-2026-90990](https://cve.now/CVE-2026-90990.md): Livestatus injection via monitoring filter values (CVSS 5.3, Checkmk)
- [CVE-2026-92882](https://cve.now/CVE-2026-92882.md): Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses (CVSS 2.3, Checkmk)
- [CVE-2026-25265](https://cve.now/CVE-2026-25265.md): Creation of Temporary File with Insecure Permissions in Qualcomm Software Center (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25264](https://cve.now/CVE-2026-25264.md): Uncontrolled Search Path Element in Qualcomm Software Center (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25262](https://cve.now/CVE-2026-25262.md): Write-what-where Condition in Primary Bootloader (CVSS 6.9, Qualcomm Snapdragon)
- [CVE-2026-25255](https://cve.now/CVE-2026-25255.md): Exposed function in Qualcomm Package Manager and Qualcomm Software Center. (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25254](https://cve.now/CVE-2026-25254.md): Improper authorization in Qualcomm Software Center (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2026-90882](https://cve.now/CVE-2026-90882.md): Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data (CVSS 8.7, Eclipse Foundation open-vsx.org)
- [CVE-2026-94117](https://cve.now/CVE-2026-94117.md): WordPress HashBar – WordPress Notification Bar plugin \<= 2.0.3 - SQL Injection vulnerability (CVSS 7.6, DevItems HashBar – WordPress Notification Bar)
- [CVE-2026-93556](https://cve.now/CVE-2026-93556.md): Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini (CVSS 9.3, Kompini Tankuam Places)
- [CVE-2026-65634](https://cve.now/CVE-2026-65634.md): Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder (CVSS 8.2, Erlang OTP)
- [CVE-2026-68956](https://cve.now/CVE-2026-68956.md): SSH daemon allocates unbounded idle session channels, bypassing max\_channels (CVSS 7.1, Erlang OTP)
- [CVE-2026-89422](https://cve.now/CVE-2026-89422.md): TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre\_shared\_key extension (CVSS 9.3, Erlang OTP)
- [CVE-2026-93928](https://cve.now/CVE-2026-93928.md): WordPress Taxi Booking Manager for WooCommerce plugin \< 2.0.8 - Broken Authentication vulnerability (CVSS 7.3, Magepeople Taxi Booking Manager for WooCommerce)
- [CVE-2026-95508](https://cve.now/CVE-2026-95508.md): Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu (CVSS 7.4, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-15095](https://cve.now/CVE-2026-15095.md): Product Feed Manager for WooCommerce \<= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter (CVSS 4.9, wahid0003 Product Feed Manager for WooCommerce – CTX Feed –…)
- [CVE-2026-9231](https://cve.now/CVE-2026-9231.md): WP Travel Engine \<= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute (CVSS 7.5, wptravelengine WP Travel Engine – Tour Booking Plugin – Tou…)
- [CVE-2026-95503](https://cve.now/CVE-2026-95503.md): Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled (CVSS 6.8, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-93836](https://cve.now/CVE-2026-93836.md): WPC Product Bundles for WooCommerce \<= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter (CVSS 7.2, wpclever WPC Product Bundles for WooCommerce)
- [CVE-2026-9004](https://cve.now/CVE-2026-9004.md): WP-CRM System \<= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact\_id' Parameter (CVSS 4.3, nofearinc WP-CRM System – Manage Clients and Projects)
- [CVE-2026-7622](https://cve.now/CVE-2026-7622.md): ThumbPress \<= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation (CVSS 4.3, codexpert ThumbPress – Compress Images, Manage Thumbnails,…)
- [CVE-2026-18345](https://cve.now/CVE-2026-18345.md): WP User Manager \<= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback (CVSS 4.3, wpusermanager WP User Manager – User Profile Builder & Memb…)
- [CVE-2025-1280](https://cve.now/CVE-2025-1280.md): BM Content Builder \< 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, SeaTheme BM Content Builder)
- [CVE-2025-14487](https://cve.now/CVE-2025-14487.md): Handily \<= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe\_publishbale\_key' Parameter (CVSS 5.3, kamleshyadav Handily)
- [CVE-2026-93778](https://cve.now/CVE-2026-93778.md): WP Yelp Review Slider \<= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp\_download\_source) (CVSS 7.2, jgwhite33 WP Yelp Review Slider)
- [CVE-2026-92235](https://cve.now/CVE-2026-92235.md): WP Ultimate Review \<= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs\_submit\_review\_data\[xs\_reviw\_summery\]' Parameter (CVSS 8.1, roxnor WP Ultimate Review)
- [CVE-2026-91092](https://cve.now/CVE-2026-91092.md): wpForo Forum \<= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo\_post\_edit Action / Forged comment\_author\_email Cookie (CVSS 4.3, tomdever wpForo Forum)
- [CVE-2026-6922](https://cve.now/CVE-2026-6922.md): WP Table Builder \<= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter (CVSS 7.1, wptb WP Table Builder – Drag & Drop Table Builder)
- [CVE-2026-1645](https://cve.now/CVE-2026-1645.md): Hostel \<= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom\_currency' Parameter and Localization file URL Setting (CVSS 4.4, prasunsen Hostel)
- [CVE-2026-18439](https://cve.now/CVE-2026-18439.md): Tutor LMS \<= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-1281](https://cve.now/CVE-2025-1281.md): BM Content Builder \< 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.8, SeaTheme BM Content Builder)
- [CVE-2026-4123](https://cve.now/CVE-2026-4123.md): RW Elephant Rental Inventory \<= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle\_cache' AJAX Action (CVSS 4.3, rwelephant01 RW Elephant Rental Inventory)
- [CVE-2025-14484](https://cve.now/CVE-2025-14484.md): Image Buzz \<= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay\_api' Parameter (CVSS 5.3, kamleshyadav Image Buzz)
- [CVE-2025-14486](https://cve.now/CVE-2025-14486.md): PixelPlay \<= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear\_api\_type' Parameter (CVSS 5.3, kamleshyadav PixelPlay)
- [CVE-2026-92969](https://cve.now/CVE-2026-92969.md): HUSKY \<= 1.4.4 - Unauthenticated Local File Inclusion via 'custom\_tpl' Shortcode Attribute via 'woof\_draw\_products' AJAX (CVSS 8.1, realmag777 HUSKY – Products Filter for WooCommerce Professi…)
- [CVE-2026-16778](https://cve.now/CVE-2026-16778.md): Live Composer \<= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc\_module\_downloads\_output' Shortcode Content (CVSS 6.4, livecomposer Live Composer – Free WordPress Website Builder)
- [CVE-2026-12995](https://cve.now/CVE-2026-12995.md): Custom Field Template \<= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file\_field' Parameter (CVSS 4.3, hiroaki-miyashita Custom Field Template)
- [CVE-2026-93952](https://cve.now/CVE-2026-93952.md): Security Advisory 0183 (CVSS 10.0, KEV, Arista Networks VeloCloud Orchestrator (VCO) On-Prem)
- [CVE-2026-87082](https://cve.now/CVE-2026-87082.md): Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode\_punycode (CVSS 7.5, Net-IDN-Encode)
- [CVE-2026-87081](https://cve.now/CVE-2026-87081.md): Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to\_ascii (CVSS 7.5, Net-IDN-Encode)
- [CVE-2026-87080](https://cve.now/CVE-2026-87080.md): Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode\_punycode (CVSS 9.1, Net-IDN-Encode)
- [CVE-2026-87079](https://cve.now/CVE-2026-87079.md): Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode\_punycode (CVSS 7.5, Net-IDN-Encode)
- [CVE-2026-87078](https://cve.now/CVE-2026-87078.md): Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode\_punycode (CVSS 9.1, Net-IDN-Encode)
- [CVE-2026-74766](https://cve.now/CVE-2026-74766.md): Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode\_punycode (CVSS 8.4, Net-IDN-Encode)
- [CVE-2026-74765](https://cve.now/CVE-2026-74765.md): Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode\_punycode (CVSS 6.5, Net-IDN-Encode)
- [CVE-2016-15059](https://cve.now/CVE-2016-15059.md): Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode\_punycode (CVSS 9.8, Net-IDN-Encode)
- [CVE-2026-91827](https://cve.now/CVE-2026-91827.md): Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export (CVSS 7.5, Ninja Forms)
- [CVE-2026-92438](https://cve.now/CVE-2026-92438.md): Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin (CVSS 8.8, Ninja Forms)
- [CVE-2026-94504](https://cve.now/CVE-2026-94504.md): Ninja Forms – The Contact Form Builder That Grows With You \<= 3.15.3 - Stored Cross-Site Scripting (CVSS 7.2, kstover Ninja Forms – Contact Form Builder with Calculators…)
- [CVE-2026-89412](https://cve.now/CVE-2026-89412.md): TranslatePress \<= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel (CVSS 7.2, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-88788](https://cve.now/CVE-2026-88788.md): Text Styler \<= 1.1.1 - Contributor+ Stored XSS (CVSS 6.8, Text Styler)
- [CVE-2026-93655](https://cve.now/CVE-2026-93655.md): Booking Calendar \<= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc\_auto\_fill' Parameter (CVSS 6.1, wpdevelop Booking Calendar)
- [CVE-2026-12470](https://cve.now/CVE-2026-12470.md): CMP \<= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp\_ajax\_import\_settings AJAX Action (CVSS 7.2, CMP – Coming Soon & Maintenance Plugin by NiteoThemes)
- [CVE-2026-85653](https://cve.now/CVE-2026-85653.md): Contextual Related Posts \<= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other\_attributes' Block Parameter (CVSS 6.4, ajay Contextual Related Posts)
- [CVE-2026-19658](https://cve.now/CVE-2026-19658.md): Give Tributes \<= 2.3.1 - Unauthenticated PHP Object Injection via 'give\_tributes\_ecard\_notify\[recipient\]\[personalized\]\[\]' Parameter (CVSS 9.8, LiquidWeb Give Tributes)
- [CVE-2026-13355](https://cve.now/CVE-2026-13355.md): Meta Box AIO \<= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb\_frontend\_field\_object\_id' Parameter (CVSS 9.8, Meta Box Frontend Submission)
- [CVE-2026-94493](https://cve.now/CVE-2026-94493.md): Gigatech PDV5701 WebSocket Service index.html missing authentication (CVSS 10.0, Gigatech PDV5701)
- [CVE-2026-93712](https://cve.now/CVE-2026-93712.md): Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public\_dir via relative path segments in the File route handler (CVSS 7.5, Dancer2)
- [CVE-2026-93711](https://cve.now/CVE-2026-93711.md): Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers\_to\_array (CVSS 6.5, Dancer2)
- [CVE-2026-93710](https://cve.now/CVE-2026-93710.md): Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile\_hooks (CVSS 7.5, Dancer2)
- [CVE-2026-93709](https://cve.now/CVE-2026-93709.md): Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler (CVSS 5.3, Dancer2)
- [CVE-2026-94492](https://cve.now/CVE-2026-94492.md): Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection (CVSS 5.3, Yonyou U8cloud)
- [CVE-2026-76974](https://cve.now/CVE-2026-76974.md): Information Disclosure vulnerability in SAP Fiori Launchpad (CVSS 5.3, SAP\_SE SAP Fiori Launchpad)
- [CVE-2026-94491](https://cve.now/CVE-2026-94491.md): Yonyou KSOA search\_list.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-37603](https://cve.now/CVE-2026-37603.md): Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) thro (CVSS 6.5)
- [CVE-2026-37604](https://cve.now/CVE-2026-37604.md): pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in \_protected/framework/Ip/Ip.class.php from th (CVSS 6.5)
- [CVE-2026-75432](https://cve.now/CVE-2026-75432.md): An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scann (CVSS 5.1)
- [CVE-2026-79311](https://cve.now/CVE-2026-79311.md): webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render\_jinja.\_\_init\_\_(). (CVSS 6.1)
- [CVE-2026-79312](https://cve.now/CVE-2026-79312.md): webpy web.py 0.76 is vulnerable to Session Fixation. (CVSS 6.8)
- [CVE-2026-79313](https://cve.now/CVE-2026-79313.md): webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. (CVSS 9.8)
- [CVE-2026-79314](https://cve.now/CVE-2026-79314.md): A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. (CVSS 8.8)
- [CVE-2026-79315](https://cve.now/CVE-2026-79315.md): A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. (CVSS 4.7)
- [CVE-2026-88339](https://cve.now/CVE-2026-88339.md): A NULL pointer dereference vulnerability exists in the gf\_sg\_vrml\_field\_clone() function of GPAC 2d7da22e (26.08-DEV). (CVSS 5.5)
- [CVE-2026-88340](https://cve.now/CVE-2026-88340.md): An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. (CVSS 7.6)
- [CVE-2026-88341](https://cve.now/CVE-2026-88341.md): A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. (CVSS 5.5)
- [CVE-2026-88344](https://cve.now/CVE-2026-88344.md): An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. (CVSS 7.5)
- [CVE-2026-88345](https://cve.now/CVE-2026-88345.md): An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. (CVSS 7.5)
- [CVE-2026-88350](https://cve.now/CVE-2026-88350.md): An integer overflow vulnerability exists in MPack 1.1.1 in mpack\_node\_cstr\_alloc() and mpack\_node\_utf8\_cstr\_alloc(). (CVSS 6.2)
- [CVE-2026-88414](https://cve.now/CVE-2026-88414.md): MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). (CVSS 9.8)
- [CVE-2026-88415](https://cve.now/CVE-2026-88415.md): MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). (CVSS 8.7)
- [CVE-2026-88416](https://cve.now/CVE-2026-88416.md): MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature. (CVSS 9.8)
- [CVE-2026-88418](https://cve.now/CVE-2026-88418.md): CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin reques (CVSS 8.8)
- [CVE-2026-88419](https://cve.now/CVE-2026-88419.md): An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of Wuzh (CVSS 8.8)
- [CVE-2026-88624](https://cve.now/CVE-2026-88624.md): Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory dele (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.