# CVEs published 2026-09-23

472 CVEs were published on September 23, 2026: 43 critical, 190 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2026-96762](https://cve.now/CVE-2026-96762.md): kvcache-ai mooncake RPC Path UnmountSegment authorization (CVSS 6.9, kvcache-ai mooncake)
- [CVE-2026-82370](https://cve.now/CVE-2026-82370.md): Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service (CVSS 8.6, Brocade SANnav)
- [CVE-2026-96751](https://cve.now/CVE-2026-96751.md): pmTicket Project-Management-Software add\_project.php setSync sql injection (CVSS 6.9, pmTicket Project-Management-Software)
- [CVE-2026-96739](https://cve.now/CVE-2026-96739.md): SEMCMS KindEditor Upload upload\_json.php cross site scripting (CVSS 5.3, SEMCMS)
- [CVE-2026-89078](https://cve.now/CVE-2026-89078.md): Double Free in GitLab (CVSS 9.9, GitLab)
- [CVE-2026-92530](https://cve.now/CVE-2026-92530.md): Use of Less Trusted Source in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-92470](https://cve.now/CVE-2026-92470.md): Missing Authorization in GitLab (CVSS 7.7, GitLab)
- [CVE-2026-92529](https://cve.now/CVE-2026-92529.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-92874](https://cve.now/CVE-2026-92874.md): Incorrect Authorization in GitLab (CVSS 5.4, GitLab)
- [CVE-2026-92628](https://cve.now/CVE-2026-92628.md): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab (CVSS 3.1, GitLab)
- [CVE-2026-93577](https://cve.now/CVE-2026-93577.md): Integer Overflow or Wraparound in GitLab (CVSS 9.9, GitLab)
- [CVE-2026-96680](https://cve.now/CVE-2026-96680.md): ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization (CVSS 5.3, ByteDance Coze Scraper Extension)
- [CVE-2026-96678](https://cve.now/CVE-2026-96678.md): weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal (CVSS 5.3, weiqingwen spring-boot-forum)
- [CVE-2026-70125](https://cve.now/CVE-2026-70125.md): Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2026-96676](https://cve.now/CVE-2026-96676.md): Fast FAC1900R uhttpd get\_alias\_name stack-based overflow (CVSS 5.3, Fast FAC1900R)
- [CVE-2026-96606](https://cve.now/CVE-2026-96606.md): LB-Link BL-CPE600EU Configuration Backup Mifi\_config.bin information disclosure (CVSS 6.9, LB-Link BL-CPE600EU)
- [CVE-2026-59980](https://cve.now/CVE-2026-59980.md): hpack: Unbounded variable integer decoding can cause run-away computation on malformed input (CVSS 6.3, python-hyper hpack · hpack)
- [CVE-2026-96604](https://cve.now/CVE-2026-96604.md): SoftNews Media Group DataLife Engine Search search.php strip\_data sql injection (CVSS 6.9, SoftNews Media Group DataLife Engine)
- [CVE-2026-96603](https://cve.now/CVE-2026-96603.md): Abdurrab5 online-makeup-store Admin functions.php confirm\_user authorization (CVSS 6.9, Abdurrab5 online-makeup-store)
- [CVE-2026-81537](https://cve.now/CVE-2026-81537.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81536](https://cve.now/CVE-2026-81536.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 7.7, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81208](https://cve.now/CVE-2026-81208.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 7.7, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-93352](https://cve.now/CVE-2026-93352.md): Laravel-Mediable 7.0.0 \< 7.0.2 RCE via .pht File Upload (CVSS 9.3, plank laravel-mediable)
- [CVE-2026-80423](https://cve.now/CVE-2026-80423.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-86583](https://cve.now/CVE-2026-86583.md): Import and export users and customers \<= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display\_name and nickname Profile Fields (CVSS 8.8, carazo Import and export users and customers)
- [CVE-2026-19125](https://cve.now/CVE-2026-19125.md): EthPress \<= 2.3.5 - Unauthenticated Authentication Bypass (CVSS 8.1, lynn999 EthPress – Web3 Login)
- [CVE-2026-75887](https://cve.now/CVE-2026-75887.md): Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler (CVSS 7.5, Red Hat OpenShift Container Platform)
- [CVE-2026-96602](https://cve.now/CVE-2026-96602.md): Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection (CVSS 6.9, Abdurrab5 online-makeup-store)
- [CVE-2026-96601](https://cve.now/CVE-2026-96601.md): Abdurrab5 online-makeup-store Admin Login index.php sql injection (CVSS 6.9, Abdurrab5 online-makeup-store)
- [CVE-2026-80425](https://cve.now/CVE-2026-80425.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-80412](https://cve.now/CVE-2026-80412.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-80379](https://cve.now/CVE-2026-80379.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-6935](https://cve.now/CVE-2026-6935.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 7.8, IBM Concert)
- [CVE-2026-6928](https://cve.now/CVE-2026-6928.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 9.8, IBM Concert)
- [CVE-2026-6925](https://cve.now/CVE-2026-6925.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.3, IBM Concert)
- [CVE-2026-6794](https://cve.now/CVE-2026-6794.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 7.8, IBM Concert)
- [CVE-2026-67221](https://cve.now/CVE-2026-67221.md): RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords (CVSS 5.9, rabbitmq-server · rabbitmq)
- [CVE-2026-75886](https://cve.now/CVE-2026-75886.md): Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding (CVSS 7.2, Red Hat OpenShift Container Platform)
- [CVE-2026-67231](https://cve.now/CVE-2026-67231.md): RabbitMQ: Trust-store whitelist by Issuer+Serial only (CVSS 9.1, rabbitmq-server · rabbitmq)
- [CVE-2026-67218](https://cve.now/CVE-2026-67218.md): RabbitMQ: Super-stream HTTP creation skips configure-permission check (CVSS 2.1, rabbitmq-server · rabbitmq)
- [CVE-2026-6730](https://cve.now/CVE-2026-6730.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 9.8, IBM Concert)
- [CVE-2026-6721](https://cve.now/CVE-2026-6721.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 9.8, IBM Concert)
- [CVE-2026-66074](https://cve.now/CVE-2026-66074.md): RabbitMQ: ReDoS via management API ?name= filter (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-82369](https://cve.now/CVE-2026-82369.md): Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a (CVSS 8.6, Brocade SANnav)
- [CVE-2026-6718](https://cve.now/CVE-2026-6718.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.2, IBM Concert)
- [CVE-2026-67232](https://cve.now/CVE-2026-67232.md): RabbitMQ: Web-MQTT decompression bomb (CVSS 8.2, rabbitmq-server · rabbitmq)
- [CVE-2026-67405](https://cve.now/CVE-2026-67405.md): RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) (CVSS 5.3, rabbitmq-server · rabbitmq)
- [CVE-2026-66075](https://cve.now/CVE-2026-66075.md): RabbitMQ: Monitoring-tag user can restart federation links (CVSS 2.3, rabbitmq-server · rabbitmq)
- [CVE-2026-67219](https://cve.now/CVE-2026-67219.md): RabbitMQ: Consistent-hash exchange unbounded weight (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-67228](https://cve.now/CVE-2026-67228.md): RabbitMQ: Atom exhaustion: to\_atom on runtime-parameter component (CVSS 6.9, rabbitmq-server · rabbitmq)
- [CVE-2026-67235](https://cve.now/CVE-2026-67235.md): RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size (CVSS 7.1, rabbitmq-server · rabbitmq)
- [CVE-2026-66068](https://cve.now/CVE-2026-66068.md): RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs (CVSS 5.6, rabbitmq-server · rabbitmq)
- [CVE-2026-67229](https://cve.now/CVE-2026-67229.md): RabbitMQ: Admin-only atom exhaustion: atomize\_keys on vhost metadata (CVSS 6.9, rabbitmq-server · rabbitmq)
- [CVE-2026-66080](https://cve.now/CVE-2026-66080.md): RabbitMQ: Super-stream partitions unbounded allocation (CVSS 5.9, rabbitmq-server · rabbitmq)
- [CVE-2026-67240](https://cve.now/CVE-2026-67240.md): RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard (CVSS 2.3, rabbitmq-server · rabbitmq)
- [CVE-2026-96556](https://cve.now/CVE-2026-96556.md): Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization (CVSS 6.9, Neethuharii CafeManagement)
- [CVE-2026-66072](https://cve.now/CVE-2026-66072.md): RabbitMQ: Atom table exhaustion via stream \`chunk\_selector\` (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-66067](https://cve.now/CVE-2026-66067.md): RabbitMQ: Stream protocol skips per vhost per user connection limits (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-66069](https://cve.now/CVE-2026-66069.md): RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics (CVSS 2.3, rabbitmq-server · rabbitmq)
- [CVE-2026-67404](https://cve.now/CVE-2026-67404.md): RabbitMQ: OAuth2 silent verify\_none fallback for JWKS fetch (CVSS 9.2, rabbitmq-server · rabbitmq)
- [CVE-2026-67220](https://cve.now/CVE-2026-67220.md): RabbitMQ: JMS topic exchange erl\_scan atom exhaustion (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-67224](https://cve.now/CVE-2026-67224.md): RabbitMQ: Admin path-traversal write via trace name (CVSS 2.1, rabbitmq-server · rabbitmq)
- [CVE-2026-66077](https://cve.now/CVE-2026-66077.md): RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI (CVSS 7.3, rabbitmq-server · rabbitmq)
- [CVE-2026-66079](https://cve.now/CVE-2026-66079.md): RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS (CVSS 8.2, rabbitmq-server · rabbitmq)
- [CVE-2026-96552](https://cve.now/CVE-2026-96552.md): sfturing hosp\_order User Password MD5.java MD5.getMD5 hash without salt (CVSS 2.3, sfturing hosp\_order)
- [CVE-2026-66070](https://cve.now/CVE-2026-66070.md): RabbitMQ: CORS \* reflects Origin with Allow-Credentials (CVSS 7.6, rabbitmq-server · rabbitmq)
- [CVE-2026-67238](https://cve.now/CVE-2026-67238.md): RabbitMQ: Atom-table exhaustion via reply-to queue name decoding (CVSS 7.1, rabbitmq-server · rabbitmq)
- [CVE-2026-66076](https://cve.now/CVE-2026-66076.md): RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure (CVSS 2.3, rabbitmq-server · rabbitmq)
- [CVE-2026-87899](https://cve.now/CVE-2026-87899.md): Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. (CVSS 9.4, WebPros cPanel)
- [CVE-2026-68492](https://cve.now/CVE-2026-68492.md): An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users (CVSS 8.7, WebPros Plesk)
- [CVE-2026-68490](https://cve.now/CVE-2026-68490.md): Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. (CVSS 8.2, WebPros cPanel)
- [CVE-2026-87900](https://cve.now/CVE-2026-87900.md): Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a (CVSS 9.4, WebPros WP Toolkit for cPanel)
- [CVE-2026-87898](https://cve.now/CVE-2026-87898.md): OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. (CVSS 9.4, WebPros Plesk extension "Site Import")
- [CVE-2026-96551](https://cve.now/CVE-2026-96551.md): sfturing hosp\_order CommonUserController.java cross-site request forgery (CVSS 5.3, sfturing hosp\_order)
- [CVE-2026-84724](https://cve.now/CVE-2026-84724.md): Automation-controller: automation-controller: systemjob extra\_vars.days argument injection into uncontainerized control-plane awx-manage process (CVSS 6.6, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84721](https://cve.now/CVE-2026-84721.md): Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil) (CVSS 6.4, Red Hat Ansible Automation Platform)
- [CVE-2026-84720](https://cve.now/CVE-2026-84720.md): Automation-controller: automation-controller: workflowjobnode.ancestor\_artifacts lacks prevent\_search, exposing no\_log set\_stats artifacts via orm-traversal count-oracle (CVSS 6.5, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84718](https://cve.now/CVE-2026-84718.md): Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust (CVSS 4.3, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84717](https://cve.now/CVE-2026-84717.md): Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates (CVSS 5.3, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84716](https://cve.now/CVE-2026-84716.md): Automation-controller: automation-controller: instance install\_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames (CVSS 6.6, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84713](https://cve.now/CVE-2026-84713.md): Automation-controller: automation-controller: notification.recipients/subject/error lack prevent\_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle (CVSS 6.5, Red Hat Ansible Automation Platform)
- [CVE-2026-84712](https://cve.now/CVE-2026-84712.md): Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership (CVSS 5.3, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-96889](https://cve.now/CVE-2026-96889.md): Librsvg: use-after-free when xml includes have duplicated entities (CVSS 7.8, Red Hat Enterprise Linux · librsvg)
- [CVE-2026-85475](https://cve.now/CVE-2026-85475.md): Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log\_aggregator\_\* settings leads to remote code execution in the control-plane rsyslog component (CVSS 7.2, Red Hat Ansible Automation Platform)
- [CVE-2026-84719](https://cve.now/CVE-2026-84719.md): Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance\_groups authorization (instancegroup use\_role bypass to control-plane) (CVSS 9.9, Red Hat Ansible Automation Platform 2.4 for RHEL · Red H… +2)
- [CVE-2026-84714](https://cve.now/CVE-2026-84714.md): Automation-controller: automation-controller: incomplete sanitize\_jinja() regex allows jinja template injection into ad-hoc module\_args, machine-credential fields, and host names, reaching ansible-core templating in the execution environment (CVSS 7.1, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84706](https://cve.now/CVE-2026-84706.md): Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash\_env/ld\_preload) allowing code execution in the execution environment (CVSS 7.6, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-75884](https://cve.now/CVE-2026-75884.md): Awx: awx: privilege escalation to openshift namespace via pod\_spec\_override injection in container groups (CVSS 9.1, Red Hat Ansible Automation Platform 2.4 for RHEL · Red H… +2)
- [CVE-2026-96550](https://cve.now/CVE-2026-96550.md): sfturing hosp\_order MailUtil.java getProperties cleartext transmission (CVSS 6.3, sfturing hosp\_order)
- [CVE-2026-96826](https://cve.now/CVE-2026-96826.md): WordPress W4 Post List plugin \<= 3.0.6 - SQL Injection vulnerability (CVSS 7.6, Shazzad Hossain Khan W4 Post List)
- [CVE-2026-82405](https://cve.now/CVE-2026-82405.md): Klever-Go Account takeover: \`kleverUpdateAccountPermission\` authorizes on attacker-controlled \`RecipientAddr\` instead of the authenticated caller (CVSS 8.7, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-82409](https://cve.now/CVE-2026-82409.md): Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -\> explorer/indexer data forgery (CVSS 8.4, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-82407](https://cve.now/CVE-2026-82407.md): Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS (CVSS 7.0, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-86065](https://cve.now/CVE-2026-86065.md): Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -\> remote node memory/goroutine exhaustion (DoS) (CVSS 7.5, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-86064](https://cve.now/CVE-2026-86064.md): Klever-Go: /log controls global node logging (CVSS 8.6, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-82406](https://cve.now/CVE-2026-82406.md): Klever-Go: Zombie-order theft: \`Buy\` missing \`IsClaimed\` guard in native marketplace (CVSS 7.1, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-84691](https://cve.now/CVE-2026-84691.md): Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret\_key and database credentials to an administrator (CVSS 8.7, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84683](https://cve.now/CVE-2026-84683.md): Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover (CVSS 8.7, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-94183](https://cve.now/CVE-2026-94183.md): Address bar spoofing risk in affected Android versions of Arc Search (CVSS 7.4, The Browser Company of New York Arc Search)
- [CVE-2026-96549](https://cve.now/CVE-2026-96549.md): sfturing hosp\_order CommonUserServiceImpl.java cleartext storage (CVSS 4.8, sfturing hosp\_order)
- [CVE-2026-93421](https://cve.now/CVE-2026-93421.md): Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint (CVSS 5.3, mesop-dev mesop · mesop)
- [CVE-2026-96770](https://cve.now/CVE-2026-96770.md): s2s-proxy accepts untrusted client certificates (CVSS 9.3, Temporal Technologies s2s-proxy)
- [CVE-2026-77602](https://cve.now/CVE-2026-77602.md): OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) (CVSS 9.9, OpenC3 cosmos · openc3)
- [CVE-2026-94181](https://cve.now/CVE-2026-94181.md): Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element (CVSS 7.4, The Browser Company of New York Arc)
- [CVE-2026-77394](https://cve.now/CVE-2026-77394.md): OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget (CVSS 7.6, OpenC3 cosmos · @openc3/vue-common)
- [CVE-2026-77601](https://cve.now/CVE-2026-77601.md): OpenC3 COSMOS: Authenticated OS command injection via the \`pypi\_url\` setting (CVSS 8.8, OpenC3 cosmos · openc3)
- [CVE-2026-96872](https://cve.now/CVE-2026-96872.md): WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions (CVSS 2.9, The Wikimedia Foundation Mediawiki - WikiLambda Extension)
- [CVE-2026-84499](https://cve.now/CVE-2026-84499.md): Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message (CVSS 7.7, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-84502](https://cve.now/CVE-2026-84502.md): Automation-controller: automation-controller-container: automation-controller: project scm\_url argument injection into \`git ls-remote --upload-pack\` yields rce on the controller-task control-plane pod (CVSS 9.9, Red Hat Ansible Automation Platform 2.4 for RHEL · Red H… +2)
- [CVE-2026-61695](https://cve.now/CVE-2026-61695.md): Wire Swift runtime: negative LENGTH\_DELIMITED length in skipGroup() crashes any protobuf-decoding service (CVSS 7.5, square wire · github.com/square/wire)
- [CVE-2026-90903](https://cve.now/CVE-2026-90903.md): Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 (CVSS 7.2, joomshaper.com Easy Store extension for Joomla)
- [CVE-2026-90901](https://cve.now/CVE-2026-90901.md): Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 (CVSS 8.6, joomshaper.com Easy Store extension for Joomla)
- [CVE-2026-90905](https://cve.now/CVE-2026-90905.md): Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 (CVSS 7.2, joomshaper.com Easy Store extension for Joomla)
- [CVE-2026-84474](https://cve.now/CVE-2026-84474.md): Automation-controller: automation-controller-container: automation-controller: view\_jobtemplate to execute privilege escalation via host\_config\_key exposure and x-forwarded-for spoofing of provisioning-callback host match (CVSS 9.9, Red Hat Ansible Automation Platform 2.4 for RHEL · Red H… +2)
- [CVE-2026-59990](https://cve.now/CVE-2026-59990.md): Jawn: Uncontrolled nesting depth in JSON parser (CVSS 7.5, typelevel jawn · org.typelevel:jawn-parser\_2.12 +2)
- [CVE-2026-82368](https://cve.now/CVE-2026-82368.md): Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to co (CVSS 8.7, Brocade SANnav)
- [CVE-2026-90902](https://cve.now/CVE-2026-90902.md): Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 (CVSS 8.6, joomshaper.com Easy Store extension for Joomla)
- [CVE-2026-61814](https://cve.now/CVE-2026-61814.md): Jawn: Quadratic parsing effort in AsyncParser (CVSS 7.5, typelevel jawn · org.typelevel jawn-parser\_2.12 +5)
- [CVE-2026-90904](https://cve.now/CVE-2026-90904.md): Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 (CVSS 8.6, joomshaper.com Easy Store extension for Joomla)
- [CVE-2026-90899](https://cve.now/CVE-2026-90899.md): Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 (CVSS 8.2, joomshaper.com Easy Store extension for Joomla)
- [CVE-2026-84486](https://cve.now/CVE-2026-84486.md): Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation of job dispatch (dos) (CVSS 8.2, Red Hat Ansible Automation Platform 2.6 for RHEL · Red Hat…)
- [CVE-2026-76087](https://cve.now/CVE-2026-76087.md): Formie: Unauthenticated users can overwrite incomplete submissions via submit action (CVSS 8.2, verbb formie · verbb/formie)
- [CVE-2026-90900](https://cve.now/CVE-2026-90900.md): Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 (CVSS 5.3, joomshaper.com Easy Store extension for Joomla)
- [CVE-2026-76086](https://cve.now/CVE-2026-76086.md): Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials (CVSS 8.5, verbb formie · verbb/formie)
- [CVE-2026-96548](https://cve.now/CVE-2026-96548.md): sfturing hosp\_order jdbc.properties hard-coded credentials (CVSS 6.3, sfturing hosp\_order)
- [CVE-2026-96546](https://cve.now/CVE-2026-96546.md): Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader (CVSS 2.5, Red Hat Enterprise Linux)
- [CVE-2026-71465](https://cve.now/CVE-2026-71465.md): Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable (CVSS 3.1, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-71464](https://cve.now/CVE-2026-71464.md): Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm\_branch prompt bypasses leading-dash git-argument guard (CVSS 3.1, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-71463](https://cve.now/CVE-2026-71463.md): Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks (CVSS 2.7, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-96545](https://cve.now/CVE-2026-96545.md): Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader (CVSS 4.4, Red Hat Enterprise Linux)
- [CVE-2026-76089](https://cve.now/CVE-2026-76089.md): Formie: Missing authorization on sent notification resend modal exposes submission PII (CVSS 7.7, verbb formie · verbb/formie)
- [CVE-2026-82356](https://cve.now/CVE-2026-82356.md): Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production (CVSS 7.5, Imprivata Enterprise Access Management)
- [CVE-2026-71462](https://cve.now/CVE-2026-71462.md): Automation-controller: automation-controller-container: automation-controller: custom\_venv\_path setting provides filesystem path-existence oracle on control pod (CVSS 4.1, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-71461](https://cve.now/CVE-2026-71461.md): Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler (CVSS 4.3, Red Hat Ansible Automation Platform)
- [CVE-2026-71460](https://cve.now/CVE-2026-71460.md): Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/ (CVSS 4.3, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-76648](https://cve.now/CVE-2026-76648.md): Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery (CVSS 8.5, Red Hat Ansible Automation Platform)
- [CVE-2026-92692](https://cve.now/CVE-2026-92692.md): Sulu: JCR-SQL2 injection via \`categories\` query parameter (unauthenticated) (CVSS 6.9, sulu · sulu/sulu)
- [CVE-2026-77423](https://cve.now/CVE-2026-77423.md): JLine: ReDoS in Built-in Less Viewer Search (CVSS 7.5, jline3)
- [CVE-2026-95604](https://cve.now/CVE-2026-95604.md): WordPress Loops & Logic plugin \<= 4.2.4 - Broken Access Control vulnerability (CVSS 7.5, Tangible Loops & Logic)
- [CVE-2026-95603](https://cve.now/CVE-2026-95603.md): WordPress Reycob Product Import Export plugin \<= 2.3.0 - PHP Object Injection vulnerability (CVSS 7.2, Victor Rodriguez Reycob Product Import Export)
- [CVE-2026-95602](https://cve.now/CVE-2026-95602.md): WordPress YITH WooCommerce Request A Quote plugin \< 4.46.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, YITH WooCommerce Request A Quote)
- [CVE-2026-95601](https://cve.now/CVE-2026-95601.md): WordPress Product Filter by WBW plugin \<= 3.1.7 - SQL Injection vulnerability (CVSS 9.3, WBW Plugins Product Filter by WBW)
- [CVE-2026-95600](https://cve.now/CVE-2026-95600.md): WordPress TrustedLogin Connector plugin \<= 2.0.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, TrustedLogin Connector)
- [CVE-2026-95593](https://cve.now/CVE-2026-95593.md): WordPress Ultimeter plugin \<= 3.0.8 - SQL Injection vulnerability (CVSS 7.6, Ben Roberts Ultimeter)
- [CVE-2026-95592](https://cve.now/CVE-2026-95592.md): WordPress Team plugin \<= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Oleh RadiusTheme Team)
- [CVE-2026-95590](https://cve.now/CVE-2026-95590.md): WordPress Tainacan plugin \<= 1.2.0 - SQL Injection vulnerability (CVSS 7.1, Tainacan)
- [CVE-2026-95586](https://cve.now/CVE-2026-95586.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.5.50 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themefic Ultimate Addons for Contact Form)
- [CVE-2026-95530](https://cve.now/CVE-2026-95530.md): WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin \<= 11.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PixelYourSite – Your smart PIXEL (TAG) Manager)
- [CVE-2026-95529](https://cve.now/CVE-2026-95529.md): WordPress Calculated Fields Form plugin \<= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codepeople Calculated Fields Form)
- [CVE-2026-95528](https://cve.now/CVE-2026-95528.md): WordPress Core Web Vitals & PageSpeed Booster plugin \<= 1.0.31 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mohammed Kaludi Core Web Vitals & PageSpeed Booster)
- [CVE-2026-95527](https://cve.now/CVE-2026-95527.md): WordPress Conekta Payment Gateway plugin \<= 6.2.4 - Broken Access Control vulnerability (CVSS 6.5, Conekta Group Conekta Payment Gateway)
- [CVE-2026-95525](https://cve.now/CVE-2026-95525.md): WordPress WP User Frontend plugin \<= 4.3.11 - Arbitrary File Deletion vulnerability (CVSS 6.5, weDevs WP User Frontend)
- [CVE-2026-95524](https://cve.now/CVE-2026-95524.md): WordPress WP User Frontend plugin \<= 4.3.11 - Bypass Vulnerability vulnerability (CVSS 5.3, weDevs WP User Frontend)
- [CVE-2026-95523](https://cve.now/CVE-2026-95523.md): WordPress WP User Frontend plugin \<= 4.3.11 - Bypass Vulnerability vulnerability (CVSS 6.5, weDevs WP User Frontend)
- [CVE-2026-95522](https://cve.now/CVE-2026-95522.md): WordPress Easy Digital Downloads plugin \<= 3.7.0 - SQL Injection vulnerability (CVSS 7.6, Syed Balkhi Easy Digital Downloads)
- [CVE-2026-95515](https://cve.now/CVE-2026-95515.md): WordPress Ninja Forms plugin \<= 3.15.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kevin Stover Ninja Forms)
- [CVE-2026-95514](https://cve.now/CVE-2026-95514.md): WordPress Netgsm plugin \<= 2.10.0 - Bypass Vulnerability vulnerability (CVSS 5.3, Netgsm)
- [CVE-2026-95513](https://cve.now/CVE-2026-95513.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.6.0 - Broken Access Control vulnerability (CVSS 7.5, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2026-94682](https://cve.now/CVE-2026-94682.md): WordPress Podcast Importer SecondLine plugin \<= 1.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SecondLineThemes Podcast Importer SecondLine)
- [CVE-2026-94680](https://cve.now/CVE-2026-94680.md): WordPress The Post Grid plugin \<= 7.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RadiusTheme The Post Grid)
- [CVE-2026-94679](https://cve.now/CVE-2026-94679.md): WordPress Fluent Support plugin \<= 2.3.2 - Broken Access Control vulnerability (CVSS 5.4, WPManageNinja Fluent Support)
- [CVE-2026-94671](https://cve.now/CVE-2026-94671.md): WordPress The Post Grid plugin \<= 7.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RadiusTheme The Post Grid)
- [CVE-2026-94500](https://cve.now/CVE-2026-94500.md): WordPress ElementsKit Elementor addons Lite plugin \<= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Roxnor ElementsKit Elementor addons Lite)
- [CVE-2026-94498](https://cve.now/CVE-2026-94498.md): WordPress AppMySite plugin \<= 3.15.4 - Broken Access Control vulnerability (CVSS 6.5, AppMySite)
- [CVE-2026-94487](https://cve.now/CVE-2026-94487.md): WordPress PublishPress Capabilities plugin \<= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.1, PublishPress Capabilities)
- [CVE-2026-94461](https://cve.now/CVE-2026-94461.md): WordPress Ditty plugin \<= 3.1.69 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, metaphorcreations Ditty)
- [CVE-2026-94457](https://cve.now/CVE-2026-94457.md): WordPress Captcha Code plugin \<= 3.32 - Bypass Vulnerability vulnerability (CVSS 4.8, WebFactory Captcha Code)
- [CVE-2026-94391](https://cve.now/CVE-2026-94391.md): WordPress Ultimate FAQ plugin \<= 2.4.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rustaurius Ultimate FAQ)
- [CVE-2026-94179](https://cve.now/CVE-2026-94179.md): WordPress Razorpay Payment Button plugin \<= 2.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Razorpay Payment Button)
- [CVE-2026-94176](https://cve.now/CVE-2026-94176.md): WordPress Mang Board WP plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kitae Park Mang Board WP)
- [CVE-2026-94174](https://cve.now/CVE-2026-94174.md): WordPress Email Log plugin \<= 2.63 - SQL Injection vulnerability (CVSS 7.6, WebFactory Email Log)
- [CVE-2026-94168](https://cve.now/CVE-2026-94168.md): WordPress Premium Addons for Elementor plugin \<= 4.11.105 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Addons for Elementor)
- [CVE-2026-94124](https://cve.now/CVE-2026-94124.md): WordPress WP EasyCart plugin \<= 5.9.4 - SQL Injection vulnerability (CVSS 8.5, levelfourdevelopment WP EasyCart)
- [CVE-2026-94118](https://cve.now/CVE-2026-94118.md): WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin \<= 2.3.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Blocks – Gutenberg Blocks for WordPress)
- [CVE-2026-94080](https://cve.now/CVE-2026-94080.md): WordPress MarketKing plugin \<= 2.1.70 - Broken Access Control vulnerability (CVSS 5.3, WebWizards MarketKing)
- [CVE-2026-94079](https://cve.now/CVE-2026-94079.md): WordPress WP User Manager plugin \<= 2.9.19 - Broken Access Control vulnerability (CVSS 5.3, WP User Manager)
- [CVE-2026-93774](https://cve.now/CVE-2026-93774.md): WordPress WP Photo Album Plus plugin \<= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jacob N. Breetvelt WP Photo Album Plus)
- [CVE-2026-93773](https://cve.now/CVE-2026-93773.md): WordPress Mollie Forms plugin \<= 2.11.0 - SQL Injection vulnerability (CVSS 8.5, Nick van Wobbie Mollie Forms)
- [CVE-2026-93772](https://cve.now/CVE-2026-93772.md): WordPress wpForo Forum plugin \<= 3.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tomdever wpForo Forum)
- [CVE-2026-93623](https://cve.now/CVE-2026-93623.md): WordPress AI Engine plugin \<= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Jordy Meow AI Engine)
- [CVE-2026-93622](https://cve.now/CVE-2026-93622.md): WordPress WPS Limit Login plugin \<= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NicolasKulka WPS Limit Login)
- [CVE-2026-93620](https://cve.now/CVE-2026-93620.md): WordPress PayPlus Payment Gateway plugin \<= 8.2.5 - Broken Access Control vulnerability (CVSS 6.5, PayPlus Tech Team PayPlus Payment Gateway)
- [CVE-2026-93618](https://cve.now/CVE-2026-93618.md): WordPress JetTricks plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock. Jetimpex JetTricks)
- [CVE-2026-93529](https://cve.now/CVE-2026-93529.md): WordPress WSP MCP - AI Agents Connector plugin \<= 2.7.0 - Broken Access Control vulnerability (CVSS 6.5, Bilal Naseer WSP MCP &#8211; AI Agents Connector)
- [CVE-2026-93527](https://cve.now/CVE-2026-93527.md): WordPress Live Copy Paste for Elementor plugin \<= 1.5.10 - SQL Injection vulnerability (CVSS 8.5, bdthemes Live Copy Paste for Elementor)
- [CVE-2026-93526](https://cve.now/CVE-2026-93526.md): WordPress Event Tickets plugin \<= 5.29.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nexcess Event Tickets)
- [CVE-2026-93513](https://cve.now/CVE-2026-93513.md): WordPress SiteSkite plugin \<= 2.1.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, SiteSkite)
- [CVE-2026-77420](https://cve.now/CVE-2026-77420.md): JLine: ReDoS via \`HISTORY\_IGNORE\` Configuration Variable (CVSS 5.5, jline3 · org.jline:jline-reader)
- [CVE-2026-77422](https://cve.now/CVE-2026-77422.md): JLine: ReDoS in Built-in grep Command Amplified by Automatic \`.\*\` Wrapping (CVSS 7.5, jline3 · org.jline:jline-builtins)
- [CVE-2026-75131](https://cve.now/CVE-2026-75131.md): NetworkManager-l2tp Privilege Escalation via pppd Username Injection (CVSS 8.5, nm-l2tp NetworkManager-l2tp)
- [CVE-2026-96541](https://cve.now/CVE-2026-96541.md): Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-71459](https://cve.now/CVE-2026-71459.md): Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure (CVSS 5.0, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-71458](https://cve.now/CVE-2026-71458.md): Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration (CVSS 5.0, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-77421](https://cve.now/CVE-2026-77421.md): JLine: ReDoS in Nano Editor Regex Search Mode (CVSS 6.5, jline3 · org.jline:jline-builtins)
- [CVE-2026-92730](https://cve.now/CVE-2026-92730.md): LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name (CVSS 7.4, LimeSurvey)
- [CVE-2026-63132](https://cve.now/CVE-2026-63132.md): OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack (CVSS 9.2, openbao · github.com/openbao/openbao)
- [CVE-2026-63131](https://cve.now/CVE-2026-63131.md): OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix) (CVSS 6.0, openbao · github.com/openbao/openbao)
- [CVE-2026-77285](https://cve.now/CVE-2026-77285.md): OpenBao Agent Writes Secrets to Stdout (CVSS 2.4, openbao · github.com/openbao/openbao)
- [CVE-2026-55632](https://cve.now/CVE-2026-55632.md): GoCD is vulnerable to authorization bypass via pipeline structure API (CVSS 4.3, gocd)
- [CVE-2026-52744](https://cve.now/CVE-2026-52744.md): GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API (CVSS 5.3, gocd)
- [CVE-2026-92700](https://cve.now/CVE-2026-92700.md): Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation (CVSS 6.3, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-92284](https://cve.now/CVE-2026-92284.md): Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS (CVSS 6.9, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-88840](https://cve.now/CVE-2026-88840.md): Busybox: busybox: tls ssl\_server reads one byte out of bounds when parsing truncated clienthello (CVSS 5.3, Red Hat Hardened Images)
- [CVE-2026-88839](https://cve.now/CVE-2026-88839.md): Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (CVSS 6.7, Red Hat Hardened Images)
- [CVE-2026-88837](https://cve.now/CVE-2026-88837.md): Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication (CVSS 6.5, Red Hat Hardened Images)
- [CVE-2026-88835](https://cve.now/CVE-2026-88835.md): Busybox: busybox: dpkg read\_package\_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages (CVSS 6.1, Red Hat Hardened Images)
- [CVE-2026-88831](https://cve.now/CVE-2026-88831.md): Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths (CVSS 5.3, Red Hat Hardened Images)
- [CVE-2026-86867](https://cve.now/CVE-2026-86867.md): Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers (CVSS 6.5, Cinnamon AI Kotaemon)
- [CVE-2026-86934](https://cve.now/CVE-2026-86934.md): An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header (CVSS 9.1, Claris FileMaker Server)
- [CVE-2026-86938](https://cve.now/CVE-2026-86938.md): A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated admini (CVSS 7.3, Claris FileMaker Pro)
- [CVE-2026-86926](https://cve.now/CVE-2026-86926.md): A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 data (CVSS 7.8, Claris FileMaker Server)
- [CVE-2026-86930](https://cve.now/CVE-2026-86930.md): An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a containe (CVSS 9.1, Claris FileMaker Server)
- [CVE-2026-91775](https://cve.now/CVE-2026-91775.md): LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings (CVSS 7.4, LimeSurvey)
- [CVE-2026-88832](https://cve.now/CVE-2026-88832.md): Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow (CVSS 7.3, Red Hat Hardened Images)
- [CVE-2026-88830](https://cve.now/CVE-2026-88830.md): Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow (CVSS 7.5, Red Hat Hardened Images)
- [CVE-2026-96808](https://cve.now/CVE-2026-96808.md): In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, valid (CVSS 7.4, Flatpak)
- [CVE-2026-96807](https://cve.now/CVE-2026-96807.md): In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate\_ld\_cache to writ (CVSS 4.0, Flatpak)
- [CVE-2026-96514](https://cve.now/CVE-2026-96514.md): Neethuharii CafeManagement Login CafePortalLogin.php sql injection (CVSS 6.9, Neethuharii CafeManagement)
- [CVE-2026-96804](https://cve.now/CVE-2026-96804.md): CVE-2026-96804 (CVSS 8.8, MLflow)
- [CVE-2026-93349](https://cve.now/CVE-2026-93349.md): Frictionless OS Command Injection via explore Console Command (CVSS 8.6, frictionlessdata frictionless-py)
- [CVE-2026-96513](https://cve.now/CVE-2026-96513.md): Neethuharii CafeManagement AddProductCode.php unrestricted upload (CVSS 6.9, Neethuharii CafeManagement)
- [CVE-2026-95848](https://cve.now/CVE-2026-95848.md): Moquette fails open when configured authentication or authorization classes cannot load (CVSS 9.3, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95847](https://cve.now/CVE-2026-95847.md): Moquette client IDs can cause cross-session H2 durable-queue corruption (CVSS 8.8, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95846](https://cve.now/CVE-2026-95846.md): Moquette publishes Last-Will messages without enforcing write authorization (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95845](https://cve.now/CVE-2026-95845.md): Moquette unbounded per-session message queues allow memory exhaustion (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95844](https://cve.now/CVE-2026-95844.md): Moquette deeply nested MQTT topics can cause stack exhaustion (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95843](https://cve.now/CVE-2026-95843.md): Moquette malformed shared subscriptions can crash command processing (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95842](https://cve.now/CVE-2026-95842.md): Moquette uncaught MQTT command exceptions can terminate shared session event loops (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-85724](https://cve.now/CVE-2026-85724.md): Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass (CVSS 9.6, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-96775](https://cve.now/CVE-2026-96775.md): MLflow dspy bypasses pickle deserialization control (CVSS 8.8, MLflow)
- [CVE-2026-96759](https://cve.now/CVE-2026-96759.md): orval before 8.29.0 Code Injection via operationId (CVSS 9.3, orval-labs orval)
- [CVE-2026-96758](https://cve.now/CVE-2026-96758.md): orval @orval/core before 8.28.0 Code Injection via Form-Data (CVSS 9.3, orval-labs orval)
- [CVE-2026-96757](https://cve.now/CVE-2026-96757.md): orval before 8.29.0 Code Injection via unescaped OpenAPI media-type (CVSS 9.3, orval-labs orval)
- [CVE-2026-96756](https://cve.now/CVE-2026-96756.md): orval before 8.30.0 Code Injection via Factory Generation (CVSS 9.2, orval-labs orval)
- [CVE-2026-96755](https://cve.now/CVE-2026-96755.md): orval @orval/effect 8.14.0 through 8.28.1 Code Injection (CVSS 9.3, orval-labs orval)
- [CVE-2026-96754](https://cve.now/CVE-2026-96754.md): orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path (CVSS 9.3, orval-labs orval)
- [CVE-2026-96656](https://cve.now/CVE-2026-96656.md): Plex Media Server arbitrary file write (CVSS 8.6, KEV, Plex Media Server)
- [CVE-2026-96655](https://cve.now/CVE-2026-96655.md): Plex Media Server arbitrary-host SSRF (CVSS 4.3, KEV, Plex Media Server)
- [CVE-2026-96654](https://cve.now/CVE-2026-96654.md): Plex Media Server URL injection (CVSS 6.9, KEV, Plex Media Server)
- [CVE-2026-96652](https://cve.now/CVE-2026-96652.md): Plex Media Server SSRF (CVSS 4.3, KEV, Plex Media Server)
- [CVE-2026-96651](https://cve.now/CVE-2026-96651.md): Plex Media Server path traversal (CVSS 6.5, Plex Media Server)
- [CVE-2026-19888](https://cve.now/CVE-2026-19888.md): NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer (CVSS 7.5, PgBouncer)
- [CVE-2026-6669](https://cve.now/CVE-2026-6669.md): Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer (CVSS 5.9, PgBouncer)
- [CVE-2026-6668](https://cve.now/CVE-2026-6668.md): Integer overflow causes an infinite loop in packet buffer growth in PgBouncer (CVSS 7.5, PgBouncer)
- [CVE-2026-6327](https://cve.now/CVE-2026-6327.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 4.3, IBM Concert)
- [CVE-2026-93769](https://cve.now/CVE-2026-93769.md): HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover (CVSS 7.2, Humhub)
- [CVE-2026-4921](https://cve.now/CVE-2026-4921.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 2.7, IBM Guardium Data Protection)
- [CVE-2026-3626](https://cve.now/CVE-2026-3626.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.3, IBM Concert)
- [CVE-2026-19267](https://cve.now/CVE-2026-19267.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.2, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-19179](https://cve.now/CVE-2026-19179.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.2, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-19087](https://cve.now/CVE-2026-19087.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 4.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18875](https://cve.now/CVE-2026-18875.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18872](https://cve.now/CVE-2026-18872.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18505](https://cve.now/CVE-2026-18505.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 5.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18490](https://cve.now/CVE-2026-18490.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18185](https://cve.now/CVE-2026-18185.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18184](https://cve.now/CVE-2026-18184.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18181](https://cve.now/CVE-2026-18181.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18180](https://cve.now/CVE-2026-18180.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-96675](https://cve.now/CVE-2026-96675.md): alsa-lib through 1.2.16.1 Denial of Service via pcm\_multi (CVSS 4.8, ALSA Project alsa-lib)
- [CVE-2026-96674](https://cve.now/CVE-2026-96674.md): alsa-lib through 1.2.16.1 Integer Overflow via Topology File (CVSS 4.8, ALSA Project alsa-lib)
- [CVE-2026-96673](https://cve.now/CVE-2026-96673.md): Photoview through 2.4.0 SQL Injection via album download route (CVSS 8.7, Photoview)
- [CVE-2026-96672](https://cve.now/CVE-2026-96672.md): Frappe ERPNext before 16.34.1 Unauthorized Method Invocation (CVSS 5.3, Frappe ERPNext)
- [CVE-2026-96276](https://cve.now/CVE-2026-96276.md): Flatpak: flatpak: arbitrary write in host context via flatpak build-init (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-96275](https://cve.now/CVE-2026-96275.md): Flatpak: flatpak: arbitrary write access as root via extra-data extraction (CVSS 8.8, Red Hat Enterprise Linux)
- [CVE-2026-96600](https://cve.now/CVE-2026-96600.md): Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks (CVSS 7.0, isotope-core)
- [CVE-2026-96599](https://cve.now/CVE-2026-96599.md): Isotope eCommerce through 2.9.10 Weak Order Identifier Generation (CVSS 8.2, isotope-core)
- [CVE-2026-92419](https://cve.now/CVE-2026-92419.md): IDOR in WEBCON BPS (CVSS 5.3, WEBCON BPS)
- [CVE-2026-55610](https://cve.now/CVE-2026-55610.md): InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover (CVSS 8.7, InvoiceShelf)
- [CVE-2026-73591](https://cve.now/CVE-2026-73591.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Cod (CVSS 7.5, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-92164](https://cve.now/CVE-2026-92164.md): Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files (CVSS 6.5, streamlink)
- [CVE-2026-73589](https://cve.now/CVE-2026-73589.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Passwor (CVSS 6.3, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-73858](https://cve.now/CVE-2026-73858.md): Solspace Freeform: Limited Twig template injection via submitted field values (CVSS 5.3, solspace craft-freeform · solspace/craft-freeform)
- [CVE-2026-73588](https://cve.now/CVE-2026-73588.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vuln (CVSS 7.4, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-73587](https://cve.now/CVE-2026-73587.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. (CVSS 6.8, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-96611](https://cve.now/CVE-2026-96611.md): FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. (CVSS 6.9, FFmpeg)
- [CVE-2026-88974](https://cve.now/CVE-2026-88974.md): WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost (CVSS 5.4, wp-graphql · wp-graphql/wp-graphql)
- [CVE-2026-73586](https://cve.now/CVE-2026-73586.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. (CVSS 6.4, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-63000](https://cve.now/CVE-2026-63000.md): REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates (CVSS 6.4, redaxo core · redaxo/source)
- [CVE-2026-96609](https://cve.now/CVE-2026-96609.md): Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognize (CVSS 7.1, Robur Albatross)
- [CVE-2026-62998](https://cve.now/CVE-2026-62998.md): REDAXO: Unwhitelisted ORDER BY Column in rex\_list Allows Authenticated Column Enumeration (CVSS 4.3, redaxo core · redaxo/source)
- [CVE-2026-63002](https://cve.now/CVE-2026-63002.md): REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames (CVSS 4.8, redaxo core · redaxo/source)
- [CVE-2026-71178](https://cve.now/CVE-2026-71178.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization (CVSS 3.7, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-63001](https://cve.now/CVE-2026-63001.md): REDAXO: Stored XSS via Unescaped Media Manager Type Name in \`mediaIsInUse()\` (CVSS 4.8, redaxo core · redaxo/source)
- [CVE-2026-71177](https://cve.now/CVE-2026-71177.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Fr (CVSS 5.4, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-61834](https://cve.now/CVE-2026-61834.md): scim-patch: Mutation of Inherited Built-in Method Objects (CVSS 4.3, thomaspoignant scim-patch · scim-patch)
- [CVE-2026-61413](https://cve.now/CVE-2026-61413.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. (CVSS 6.8, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-18179](https://cve.now/CVE-2026-18179.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-59167](https://cve.now/CVE-2026-59167.md): SunEditor: Critical XSS vulnerability - sanitizer bypass (CVSS 10.0, JiHong88 suneditor · suneditor)
- [CVE-2026-18177](https://cve.now/CVE-2026-18177.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-86678](https://cve.now/CVE-2026-86678.md): Broken Authentication vulnerability (CVSS 8.8, Zohocorp ManageEngine Applications Manager)
- [CVE-2026-86677](https://cve.now/CVE-2026-86677.md): Broken Authentication vulnerability (CVSS 8.8, Zohocorp ManageEngine Applications Manager)
- [CVE-2026-96560](https://cve.now/CVE-2026-96560.md): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel (CVSS 9.3, ModelTC LightLLM)
- [CVE-2026-86679](https://cve.now/CVE-2026-86679.md): Broken Access Control vulnerability (CVSS 7.1, Zohocorp ManageEngine Applications Manager)
- [CVE-2026-12974](https://cve.now/CVE-2026-12974.md): Security Policy Bypass in Forcepoint Security Engine (NGFW) (CVSS 7.9, Forcepoint Security Engine)
- [CVE-2026-86683](https://cve.now/CVE-2026-86683.md): Broken Authentication Vulnerability (CVSS 8.1, Zohocorp ManageEngine Applications Manager)
- [CVE-2026-96512](https://cve.now/CVE-2026-96512.md): Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization (CVSS 7.8, Red Hat Enterprise Linux · Red Hat Hardened Images +2)
- [CVE-2026-86681](https://cve.now/CVE-2026-86681.md): Broken Access Control vulnerability (CVSS 7.6, Zohocorp ManageEngine Applications Manager)
- [CVE-2026-86708](https://cve.now/CVE-2026-86708.md): Sensitive data exposure (CVSS 10.0, Zohocorp ManageEngine Applications Manager)
- [CVE-2026-95676](https://cve.now/CVE-2026-95676.md): AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass (CVSS 7.4, WatchGuard AuthPoint Authentication Gateway)
- [CVE-2026-19599](https://cve.now/CVE-2026-19599.md): Remote Code Execution vulnerability (CVSS 9.9, Zohocorp ManageEngine OpManager)
- [CVE-2026-75825](https://cve.now/CVE-2026-75825.md): Authentication Bypass vulnerability (CVSS 8.8, Zohocorp ManageEngine OpManager)
- [CVE-2026-86247](https://cve.now/CVE-2026-86247.md): Apache Tomcat Native: Client certificate requirements can be down-graded (CVSS 7.4, Apache Software Foundation Apache Tomcat Native)
- [CVE-2026-76978](https://cve.now/CVE-2026-76978.md): Command Injection vulnerability (CVSS 8.8, Zohocorp ManageEngine OpManager · ZohoCorp ManageEngine Fir…)
- [CVE-2026-86246](https://cve.now/CVE-2026-86246.md): Apache Tomcat Native: Insecure OpenSSL options enabled (CVSS 9.1, Apache Software Foundation Apache Tomcat Native)
- [CVE-2026-86243](https://cve.now/CVE-2026-86243.md): Apache Tomcat Native: DoS via TLS handshake (CVSS 7.5, Apache Software Foundation Apache Tomcat Native)
- [CVE-2026-76979](https://cve.now/CVE-2026-76979.md): XML Injection vulnerability (CVSS 7.7, Zohocorp ManageEngine OpManager · ZohoCorp ManageEngine Fir…)
- [CVE-2026-84091](https://cve.now/CVE-2026-84091.md): SUMIT Payment Gateway for WooCommerce \< 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN (CVSS 5.3, SUMIT Payment Gateway for WooCommerce)
- [CVE-2026-76980](https://cve.now/CVE-2026-76980.md): Data Exposure vulnerability (CVSS 7.4, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine Fir…)
- [CVE-2026-77112](https://cve.now/CVE-2026-77112.md): SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll (CVSS 6.5, Global IT Informatics Technology Services Weoll)
- [RUSTSEC-2026-0394](https://cve.now/RUSTSEC-2026-0394.md): Build environment compiled into the library and readable at runtime (no CVSS, rustpython-vm)
- [CVE-2026-84787](https://cve.now/CVE-2026-84787.md): Privilege Escalation vulnerability (CVSS 8.1, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine Fir…)
- [CVE-2026-84789](https://cve.now/CVE-2026-84789.md): Broken Access Control vulnerability (CVSS 7.1, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine Fir…)
- [CVE-2026-84791](https://cve.now/CVE-2026-84791.md): Broken Access Control vulnerability (CVSS 7.1, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine Fir…)
- [CVE-2026-80444](https://cve.now/CVE-2026-80444.md): Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS (CVSS 5.4, Abis Technology Ltd. AVESİS)
- [CVE-2026-78253](https://cve.now/CVE-2026-78253.md): Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt (CVSS 2.3, qt)
- [CVE-2026-15358](https://cve.now/CVE-2026-15358.md): Path Traversal Vulnerability (CVSS 7.5, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine Net…)
- [CVE-2026-87022](https://cve.now/CVE-2026-87022.md): Apache Tomcat: WebSocket message smuggling with per-message-deflate (CVSS 7.5, Apache Software Foundation Apache Tomcat)
- [CVE-2026-86350](https://cve.now/CVE-2026-86350.md): Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up (CVSS 9.1, Apache Software Foundation Apache Tomcat)
- [CVE-2026-86248](https://cve.now/CVE-2026-86248.md): Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVSS 9.8, Apache Software Foundation Apache Tomcat)
- [CVE-2026-14913](https://cve.now/CVE-2026-14913.md): SQL Injection vulnerability (CVSS 8.8, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine Fir…)
- [CVE-2026-79677](https://cve.now/CVE-2026-79677.md): Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout (CVSS 7.5, Apache Software Foundation Apache Tomcat)
- [CVE-2026-78437](https://cve.now/CVE-2026-78437.md): Apache Tomcat: HTTP/2 DoS via malformed request (CVSS 7.3, Apache Software Foundation Apache Tomcat)
- [CVE-2026-78383](https://cve.now/CVE-2026-78383.md): Apache Tomcat: AJP DoS via missing request body (CVSS 7.5, Apache Software Foundation Apache Tomcat)
- [CVE-2026-77791](https://cve.now/CVE-2026-77791.md): Apache Tomcat: DoS via busy wait during WebSocket close (CVSS 7.5, Apache Software Foundation Apache Tomcat)
- [CVE-2026-12370](https://cve.now/CVE-2026-12370.md): Remote Code Execution Vulnerability (CVSS 7.6, Zohocorp ManageEngine OpManager · Zohocorp ManageEngine… +1)
- [CVE-2026-77762](https://cve.now/CVE-2026-77762.md): Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request (CVSS 8.1, Apache Software Foundation Apache Tomcat)
- [CVE-2026-77756](https://cve.now/CVE-2026-77756.md): Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests (CVSS 3.7, Apache Software Foundation Apache Tomcat)
- [CVE-2026-76183](https://cve.now/CVE-2026-76183.md): Apache Tomcat: Bypass of security constraints for WebSocket endpoints (CVSS 9.8, Apache Software Foundation Apache Tomcat)
- [CVE-2026-75973](https://cve.now/CVE-2026-75973.md): Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured (CVSS 7.3, Apache Software Foundation Apache Tomcat)
- [CVE-2026-96445](https://cve.now/CVE-2026-96445.md): Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers (CVSS 6.8, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-73581](https://cve.now/CVE-2026-73581.md): Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (CVSS 6.5, Apache Software Foundation Apache Tomcat)
- [CVE-2026-96446](https://cve.now/CVE-2026-96446.md): Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path (CVSS 4.2, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-5696](https://cve.now/CVE-2026-5696.md): Multiple vulnerabilities in the Microweber administration panel (CVSS 5.9, Microweber Administration panel)
- [CVE-2026-5695](https://cve.now/CVE-2026-5695.md): Multiple vulnerabilities in the Microweber administration panel (CVSS 8.4, Microweber Administration panel)
- [CVE-2026-90950](https://cve.now/CVE-2026-90950.md): Paid Member Subscriptions \< 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form (CVSS 5.3, Paid Membership Subscriptions)
- [CVE-2026-87978](https://cve.now/CVE-2026-87978.md): Paymob for WooCommerce \< 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback (CVSS 5.3, Paymob for WooCommerce)
- [CVE-2026-87848](https://cve.now/CVE-2026-87848.md): MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure (CVSS 3.7, MPCX Lightbox)
- [CVE-2026-87071](https://cve.now/CVE-2026-87071.md): Forminator Forms \< 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts (CVSS 5.3, Forminator Forms)
- [CVE-2026-87070](https://cve.now/CVE-2026-87070.md): Forminator Forms \< 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing (CVSS 5.3, Forminator Forms)
- [CVE-2026-86612](https://cve.now/CVE-2026-86612.md): Ninja Tables \< 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source (CVSS 5.6, Ninja Tables)
- [CVE-2026-86604](https://cve.now/CVE-2026-86604.md): GTranslate \< 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation (CVSS 4.8, GTranslate)
- [CVE-2026-86601](https://cve.now/CVE-2026-86601.md): WP Recipe Maker \< 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content (CVSS 6.5, WP Recipe Maker)
- [CVE-2026-96442](https://cve.now/CVE-2026-96442.md): Emacs: emacs: arbitrary code execution in flymake mode (CVSS 7.8, GNU Emacs · Red Hat Enterprise Linux)
- [CVE-2026-96456](https://cve.now/CVE-2026-96456.md): Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device (CVSS 6.3, Pollen Robotics Reachy Mini)
- [CVE-2026-96455](https://cve.now/CVE-2026-96455.md): Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint (CVSS 8.8, Pollen Robotics Reachy Mini)
- [CVE-2026-96454](https://cve.now/CVE-2026-96454.md): Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applications (CVSS 8.2, tw93 Pake)
- [CVE-2026-79616](https://cve.now/CVE-2026-79616.md): Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick (CVSS 0.6, qt)
- [CVE-2026-94243](https://cve.now/CVE-2026-94243.md): Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence (CVSS 7.3, Apache Software Foundation Apache Sling Security Bundle)
- [CVE-2026-95627](https://cve.now/CVE-2026-95627.md): Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion (CVSS 7.7, tauri-plugin-dialog)
- [CVE-2026-94251](https://cve.now/CVE-2026-94251.md): Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource (CVSS 6.5, Apache Software Foundation Apache Sling Security Bundle)
- [CVE-2026-91928](https://cve.now/CVE-2026-91928.md): Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms (CVSS 6.1, Apache Software Foundation Apache Sling XSS)
- [CVE-2026-96443](https://cve.now/CVE-2026-96443.md): Apache Doris: JDBC driver URL validation bypass leads to remote code execution (CVSS 6.5, Apache Software Foundation Apache Doris)
- [CVE-2026-95626](https://cve.now/CVE-2026-95626.md): Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains (CVSS 8.3, tauri)
- [CVE-2026-91852](https://cve.now/CVE-2026-91852.md): Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl (CVSS 6.1, Apache Software Foundation Apache Sling XSS)
- [CVE-2026-91999](https://cve.now/CVE-2026-91999.md): Apache Sling XSS: Improper escaping in the XSS Webconsole plugin (CVSS 6.1, Apache Software Foundation Apache Sling XSS)
- [CVE-2026-92001](https://cve.now/CVE-2026-92001.md): Apache Sling XSS: Missing parser resource limits (CVSS 6.1, Apache Software Foundation Apache Sling XSS)
- [CVE-2026-73192](https://cve.now/CVE-2026-73192.md): Apache Sling XSS: XSS possible through XSSAPI.getValidHref() (CVSS 6.1, Apache Software Foundation Apache Sling XSS)
- [CVE-2026-31377](https://cve.now/CVE-2026-31377.md): Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service (CVSS 7.5, Apache Software Foundation Apache Doris)
- [CVE-2026-42801](https://cve.now/CVE-2026-42801.md): Deference after null check in as\_rrc (CVSS 7.4, ASR Crane，Falcon)
- [CVE-2026-95625](https://cve.now/CVE-2026-95625.md): Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade (CVSS 5.9, tauri-plugin-updater)
- [CVE-2026-93368](https://cve.now/CVE-2026-93368.md): Rename wp-login.php to anything you want \<= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter (CVSS 7.5, travispluse Rename wp-login.php to anything you want)
- [CVE-2026-15027](https://cve.now/CVE-2026-15027.md): Changing｜CGServiSign - OS Command Injection (CVSS 8.6, Changing CGServiSign)
- [CVE-2026-91788](https://cve.now/CVE-2026-91788.md): Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability (CVSS 4.7, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91790](https://cve.now/CVE-2026-91790.md): Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91791](https://cve.now/CVE-2026-91791.md): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91792](https://cve.now/CVE-2026-91792.md): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91793](https://cve.now/CVE-2026-91793.md): Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91794](https://cve.now/CVE-2026-91794.md): Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91795](https://cve.now/CVE-2026-91795.md): Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91796](https://cve.now/CVE-2026-91796.md): Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulnerability (CVSS 6.1, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91797](https://cve.now/CVE-2026-91797.md): Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91799](https://cve.now/CVE-2026-91799.md): Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91805](https://cve.now/CVE-2026-91805.md): Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handling (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91800](https://cve.now/CVE-2026-91800.md): Foxit PDF Editor installer local privilege escalation (CVSS 8.8, Foxit Software Foxit PDF Editor)
- [CVE-2026-91801](https://cve.now/CVE-2026-91801.md): Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91802](https://cve.now/CVE-2026-91802.md): Foxit PDF Editor/Reader — Heap Buffer Overflow in WebP Image Decoding via Bitmap Stride Confusion (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91804](https://cve.now/CVE-2026-91804.md): Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While Rendering (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91806](https://cve.now/CVE-2026-91806.md): Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91807](https://cve.now/CVE-2026-91807.md): Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 6.1, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91798](https://cve.now/CVE-2026-91798.md): Foxit PDF Editor/Reader Updater Privilege Escalation (CVSS 8.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91803](https://cve.now/CVE-2026-91803.md): Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijacking (CVSS 8.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91808](https://cve.now/CVE-2026-91808.md): Foxit PDF Editor/Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 6.1, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91810](https://cve.now/CVE-2026-91810.md): Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 6.1, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91811](https://cve.now/CVE-2026-91811.md): Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91812](https://cve.now/CVE-2026-91812.md): Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability (CVSS 7.9, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91813](https://cve.now/CVE-2026-91813.md): Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability (CVSS 8.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91815](https://cve.now/CVE-2026-91815.md): Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91814](https://cve.now/CVE-2026-91814.md): Security vulnerability: Foxit PDF Editor/Reader Fails to Detect Modifications to Signed Documents Displaying Newly Added Content (CVSS 5.3, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91816](https://cve.now/CVE-2026-91816.md): Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91817](https://cve.now/CVE-2026-91817.md): Foxit PDF Editor/Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability (CVSS 6.1, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91818](https://cve.now/CVE-2026-91818.md): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91789](https://cve.now/CVE-2026-91789.md): Foxit PDF Editor/Reader U3D File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-91809](https://cve.now/CVE-2026-91809.md): Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 7.8, Foxit Software Foxit PDF Editor · Foxit Software Foxit PDF…)
- [CVE-2026-92378](https://cve.now/CVE-2026-92378.md): uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login (CVSS 4.1, NT-ware uniFLOW Online)
- [CVE-2026-50228](https://cve.now/CVE-2026-50228.md): Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense (CVSS 6.1, Acer NitroSense)
- [CVE-2026-50227](https://cve.now/CVE-2026-50227.md): MQTT WebSocket Command Execution Vulnerability in NitroSense (CVSS 6.1, Acer NitroSense)
- [CVE-2026-82331](https://cve.now/CVE-2026-82331.md): Apache BuildStream: tar source extraction escape (CVSS 9.8, Apache Software Foundation Apache BuildStream)
- [CVE-2026-6831](https://cve.now/CVE-2026-6831.md): Advanced Contact form 7 DB \<= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode (CVSS 6.5, vsourz1td Advanced Contact form 7 DB)
- [CVE-2026-5924](https://cve.now/CVE-2026-5924.md): Getwid \<= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' (CVSS 6.4, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2026-93528](https://cve.now/CVE-2026-93528.md): NP Quote Request for WooCommerce \< 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page (CVSS 3.7, NP Quote Request for WooCommerce)
- [CVE-2026-93511](https://cve.now/CVE-2026-93511.md): Premium Packages \< 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass (CVSS 5.3, Premium Packages)
- [CVE-2026-93510](https://cve.now/CVE-2026-93510.md): Points and Rewards for WooCommerce \< 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign\_claim\_points (CVSS 4.3, Points and Rewards for WooCommerce)
- [CVE-2026-93508](https://cve.now/CVE-2026-93508.md): WC Fields Factory \< 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX (CVSS 8.1, WC Fields Factory)
- [CVE-2026-93507](https://cve.now/CVE-2026-93507.md): WC Fields Factory \< 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure (CVSS 3.3, WC Fields Factory)
- [CVE-2026-91077](https://cve.now/CVE-2026-91077.md): Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem\_load\_event\_list (CVSS 2.7, Event Booking Manager for WooCommerce)
- [CVE-2026-91073](https://cve.now/CVE-2026-91073.md): Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting (CVSS 6.8, Subscribe Forms)
- [CVE-2026-91025](https://cve.now/CVE-2026-91025.md): Booking Manager \< 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR (CVSS 4.3, Booking Manager)
- [CVE-2026-91024](https://cve.now/CVE-2026-91024.md): Booking Manager \< 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync\_gid) (CVSS 6.8, Booking Manager)
- [CVE-2026-90985](https://cve.now/CVE-2026-90985.md): WPC Smart Compare for WooCommerce \< 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc\_load (CVSS 5.3, WPC Smart Compare for WooCommerce)
- [CVE-2026-90951](https://cve.now/CVE-2026-90951.md): Paid Member Subscriptions \< 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms\_process\_payment (CVSS 3.7, Paid Membership Subscriptions)
- [CVE-2026-89331](https://cve.now/CVE-2026-89331.md): FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints (CVSS 5.3, FluentBoards)
- [CVE-2026-88997](https://cve.now/CVE-2026-88997.md): JSM Show Post Metadata \< 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key (CVSS 6.8, JSM Show Post Metadata)
- [CVE-2026-88929](https://cve.now/CVE-2026-88929.md): Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure (CVSS 5.3, Product Badge, Label, Countdown Timer for WooCommerce)
- [CVE-2026-87981](https://cve.now/CVE-2026-87981.md): Paymob for WooCommerce \< 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions (CVSS 4.7, Paymob for WooCommerce)
- [CVE-2026-87979](https://cve.now/CVE-2026-87979.md): Paymob for WooCommerce \< 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook (CVSS 5.3, Paymob for WooCommerce)
- [CVE-2026-87074](https://cve.now/CVE-2026-87074.md): Forminator Forms \< 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link (CVSS 3.7, Forminator Forms)
- [CVE-2026-87069](https://cve.now/CVE-2026-87069.md): Forminator Forms \< 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate\_stripe (CVSS 3.1, Forminator Forms)
- [CVE-2026-86842](https://cve.now/CVE-2026-86842.md): Real3D Flipbook Lite \< 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite (CVSS 6.8, Real3D Flipbook)
- [CVE-2026-86783](https://cve.now/CVE-2026-86783.md): PostX \< 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API (CVSS 5.3, Post Grid Gutenberg Blocks)
- [CVE-2026-86608](https://cve.now/CVE-2026-86608.md): WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion (CVSS 8.2, WP Recipe Maker)
- [CVE-2026-86603](https://cve.now/CVE-2026-86603.md): WP Recipe Maker \< 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm\_search\_lists (CVSS 4.3, WP Recipe Maker)
- [CVE-2026-86602](https://cve.now/CVE-2026-86602.md): WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm\_shortcode\_preview (CVSS 4.3, WP Recipe Maker)
- [CVE-2026-85006](https://cve.now/CVE-2026-85006.md): Happy Addons for Elementor \< 3.50.0 - Contributor+ Stored XSS via Creative Button Widget (CVSS 6.8, HappyAddons for Elementor)
- [CVE-2026-84743](https://cve.now/CVE-2026-84743.md): The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes (CVSS 3.8, The Events Calendar)
- [CVE-2026-84742](https://cve.now/CVE-2026-84742.md): The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API (CVSS 2.7, The Events Calendar)
- [CVE-2026-84741](https://cve.now/CVE-2026-84741.md): The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API (CVSS 5.3, The Events Calendar)
- [CVE-2026-84168](https://cve.now/CVE-2026-84168.md): Easy Hide Login \< 1.7 - Login Page Protection Bypass / Hidden URL Disclosure (CVSS 5.3, Easy Hide Login)
- [CVE-2026-84150](https://cve.now/CVE-2026-84150.md): Directorist \< 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint (CVSS 5.4, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-84098](https://cve.now/CVE-2026-84098.md): Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove\_listing (CVSS 6.5, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-84046](https://cve.now/CVE-2026-84046.md): Directorist \< 8.9.5 - Subscriber+ SSRF via Avatar URL (CVSS 5.0, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-84027](https://cve.now/CVE-2026-84027.md): Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint (CVSS 4.3, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-84026](https://cve.now/CVE-2026-84026.md): Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint (CVSS 5.3, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-83555](https://cve.now/CVE-2026-83555.md): Email Subscribers by Icegram Express \< 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification (CVSS 5.3, Email Subscribers & Newsletters)
- [CVE-2026-82843](https://cve.now/CVE-2026-82843.md): WP OAuth Server \< 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution (CVSS 9.0, WP OAuth Server)
- [CVE-2026-81339](https://cve.now/CVE-2026-81339.md): MasterStudy LMS \< 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR (CVSS 4.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81338](https://cve.now/CVE-2026-81338.md): MasterStudy LMS \< 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions (CVSS 4.6, MasterStudy LMS WordPress Plugin)
- [CVE-2026-80342](https://cve.now/CVE-2026-80342.md): Payment Plugins for PayPal WooCommerce \< 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID (CVSS 6.5, Payment Plugins for PayPal WooCommerce)
- [CVE-2026-77766](https://cve.now/CVE-2026-77766.md): Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint (CVSS 4.3, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-77765](https://cve.now/CVE-2026-77765.md): Better Payment \< 2.3.4 - Unauthenticated Payment Amount Manipulation (CVSS 5.3, Better Payment)
- [CVE-2026-75799](https://cve.now/CVE-2026-75799.md): YAHMAN Add-ons \< 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache (CVSS 9.0, YAHMAN Add-ons)
- [CVE-2026-18365](https://cve.now/CVE-2026-18365.md): Zportals \< 6.4.2 - Subscriber+ User Email Disclosure (CVSS 4.3, zportals)
- [CVE-2026-18364](https://cve.now/CVE-2026-18364.md): Zportals \< 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update (CVSS 4.3, zportals)
- [CVE-2026-16264](https://cve.now/CVE-2026-16264.md): Newsletters \< 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR (CVSS 6.5, Newsletters)
- [CVE-2026-14321](https://cve.now/CVE-2026-14321.md): Divi Dash \< 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing (CVSS 8.2, divi-dash)
- [CVE-2025-15696](https://cve.now/CVE-2025-15696.md): Real3D Flipbook Lite \< 5.4 - Author+ Stored XSS (CVSS 6.8, Real3D Flipbook)
- [CVE-2022-4997](https://cve.now/CVE-2022-4997.md): JetFormBuilder Stripe Gateway \< 1.1.0 - Unauthenticated Blind SQLi via Payment Token (CVSS 8.6, jet-form-builder-stripe-gateway)
- [CVE-2026-86785](https://cve.now/CVE-2026-86785.md): Social Commerce for WooCommerce \<= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update (CVSS 5.3, Social Commerce for WooCommerce)
- [CVE-2026-19438](https://cve.now/CVE-2026-19438.md): Mint Workbench I Path traversal Vulnerability (CVSS 7.5, ABB Mint Workbench I)
- [CVE-2026-96258](https://cve.now/CVE-2026-96258.md): onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting (CVSS 5.3, onSite internet Auktion NG Auktionssoftware)
- [CVE-2026-96257](https://cve.now/CVE-2026-96257.md): Fast FAC1203R Gigabit Edition Device Discovery Service copy\_msg\_element stack-based overflow (CVSS 10.0, Fast FAC1203R Gigabit Edition)
- [CVE-2026-95958](https://cve.now/CVE-2026-95958.md): JusticeRage Manalyze PE Parser pe.cpp \_parse\_relocations integer underflow (CVSS 4.8, JusticeRage Manalyze)
- [CVE-2026-95957](https://cve.now/CVE-2026-95957.md): SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student\_signup.php prepend cross site scripting (CVSS 5.3, SourceCodester Smart Attendance System with QR Code Scanner)
- [CVE-2026-91777](https://cve.now/CVE-2026-91777.md): jackson-databind: quadratic forward-reference completion in Collection and Map deserializers (CVSS 7.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-91776](https://cve.now/CVE-2026-91776.md): jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID (CVSS 7.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-95930](https://cve.now/CVE-2026-95930.md): iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery (CVSS 5.3, iFlytek astron-agent)
- [CVE-2026-89425](https://cve.now/CVE-2026-89425.md): jackson-core: UTF8DataInputJsonParser.\_reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth (CVSS 7.5, FasterXML jackson-core · com.fasterxml.jackson.core:jack… +1)
- [CVE-2026-95929](https://cve.now/CVE-2026-95929.md): iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection (CVSS 5.3, iFlytek astron-agent)
- [CVE-2026-95928](https://cve.now/CVE-2026-95928.md): recommenders-team recommenders Dict Loading mind\_iterator.py pickle.load deserialization (CVSS 5.1, recommenders-team recommenders)
- [CVE-2026-95927](https://cve.now/CVE-2026-95927.md): SourceCodester Online Reviewer Management System exam-delete.php sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-95926](https://cve.now/CVE-2026-95926.md): SourceCodester Online Reviewer Management System btn\_functions.php update sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-95925](https://cve.now/CVE-2026-95925.md): SourceCodester Online Reviewer Management System btn\_functions.php update sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-95924](https://cve.now/CVE-2026-95924.md): SourceCodester Online Reviewer Management System btn\_functions.php add sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-95897](https://cve.now/CVE-2026-95897.md): Dask Loader core.py from\_npy\_stack deserialization (CVSS 5.1, Dask)
- [CVE-2026-96273](https://cve.now/CVE-2026-96273.md): Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB (CVSS 6.8, NationalSecurityAgency ghidra)
- [CVE-2026-96272](https://cve.now/CVE-2026-96272.md): ClipBucket v5 before 5.5.3-#182 SQL Injection via search\_result.php (CVSS 8.7, MacWarrior clipbucket-v5)
- [CVE-2026-96271](https://cve.now/CVE-2026-96271.md): Photoview through 2.4.0 Authorization Bypass via shareAlbum (CVSS 7.1, photoview)
- [CVE-2026-95868](https://cve.now/CVE-2026-95868.md): AdithyaYelloju Restaurant-Management-System Search Form display\_menu.php mysqli\_query sql injection (CVSS 5.3, AdithyaYelloju Restaurant-Management-System)
- [CVE-2025-63564](https://cve.now/CVE-2025-63564.md): SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP re (CVSS 9.8)
- [CVE-2026-79304](https://cve.now/CVE-2026-79304.md): CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. (CVSS 6.5)
- [CVE-2026-79306](https://cve.now/CVE-2026-79306.md): CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. (CVSS 6.5)
- [CVE-2026-79310](https://cve.now/CVE-2026-79310.md): webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). (CVSS 8.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.