# CVEs published 2026-09-24

552 CVEs were published on September 24, 2026: 34 critical, 185 high. Days are UTC.

- [CVE-2026-85082](https://cve.now/CVE-2026-85082.md): Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames (CVSS 8.5, Maple Media Root Browser Classic)
- [CVE-2026-84283](https://cve.now/CVE-2026-84283.md): FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate (CVSS 6.8, FluteCode Secure Folder)
- [CVE-2026-97230](https://cve.now/CVE-2026-97230.md): IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL (CVSS 9.8, IO-Socket-SSL-SelfCertificate)
- [CVE-2026-87722](https://cve.now/CVE-2026-87722.md): Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review (CVSS 8.7, Gerrit)
- [CVE-2026-87721](https://cve.now/CVE-2026-87721.md): Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review (CVSS 8.7, Gerrit)
- [CVE-2026-87720](https://cve.now/CVE-2026-87720.md): Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review (CVSS 7.6, Gerrit)
- [CVE-2026-97636](https://cve.now/CVE-2026-97636.md): Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key (CVSS 6.5, Apache Software Foundation Apache Airflow HashiCorp provider)
- [CVE-2026-85491](https://cve.now/CVE-2026-85491.md): Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone (CVSS 8.8, Catalyst-Seal)
- [CVE-2026-14441](https://cve.now/CVE-2026-14441.md): Logic flaw in SANnav Java cache key handling object comparison handling (CVSS 6.9, Brocade SANnav)
- [CVE-2026-14442](https://cve.now/CVE-2026-14442.md): Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a (CVSS 6.9, Brocade SANnav)
- [CVE-2026-95699](https://cve.now/CVE-2026-95699.md): MrSteam iSteamX Improper Isolation or Compartmentalization (CVSS 8.4, MrSteam iSteamX application · MrSteam iSteamX Hub)
- [CVE-2026-97368](https://cve.now/CVE-2026-97368.md): chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization (CVSS 5.3, chillzhuang SpringBlade)
- [CVE-2026-93353](https://cve.now/CVE-2026-93353.md): copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers (CVSS 2.3, 9001 copyparty)
- [CVE-2026-82585](https://cve.now/CVE-2026-82585.md): Botslab G980H Dashcams Cleartext Transmission of Sensitive Information (CVSS 7.1, Botslab G980H)
- [CVE-2026-79959](https://cve.now/CVE-2026-79959.md): Botslab G980H Dashcams Use of Hard-coded Credentials (CVSS 7.0, Botslab G980H)
- [CVE-2026-82708](https://cve.now/CVE-2026-82708.md): Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory (CVSS 7.1, Botslab G980H)
- [CVE-2026-87118](https://cve.now/CVE-2026-87118.md): Botslab G980H Dashcams Out-of-bounds Write (CVSS 6.9, Botslab G980H)
- [CVE-2026-97366](https://cve.now/CVE-2026-97366.md): jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection (CVSS 5.3, jhen0409 react-native-debugger)
- [CVE-2026-81630](https://cve.now/CVE-2026-81630.md): Botslab G980H Dashcams Insufficient Verification of Data Authenticity (CVSS 9.2, Botslab G980H)
- [CVE-2026-75558](https://cve.now/CVE-2026-75558.md): Botslab G980H Dashcams Use of Hard-coded Cryptographic Key (CVSS 6.0, Botslab G980H)
- [CVE-2026-84403](https://cve.now/CVE-2026-84403.md): Botslab G980H Dashcams Missing Authentication for Critical Function (CVSS 6.9, Botslab G980H)
- [CVE-2026-14443](https://cve.now/CVE-2026-14443.md): Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a (CVSS 8.4, Brocade SANnav)
- [CVE-2026-82716](https://cve.now/CVE-2026-82716.md): Botslab G980H Dashcams Insertion of Sensitive Information into Log File (CVSS 5.1, Botslab G980H)
- [CVE-2026-97365](https://cve.now/CVE-2026-97365.md): chonkie-inc littrs lib.rs mount path traversal (CVSS 5.3, chonkie-inc littrs)
- [CVE-2026-88956](https://cve.now/CVE-2026-88956.md): Botslab G980H Dashcams Missing Authentication for Critical Function (CVSS 7.0, Botslab G980H)
- [CVE-2026-93354](https://cve.now/CVE-2026-93354.md): Taskview Community Missing Authentication via OAuth Dynamic Client Registration (CVSS 8.5, Gimanh taskview-community)
- [CVE-2026-88761](https://cve.now/CVE-2026-88761.md): Botslab G980H Dashcams Use of Weak Credentials (CVSS 5.3, Botslab G980H)
- [CVE-2026-77967](https://cve.now/CVE-2026-77967.md): Botslab G980H Dashcams Authentication Bypass by Capture-replay (CVSS 8.1, Botslab G980H)
- [CVE-2026-85496](https://cve.now/CVE-2026-85496.md): Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers (CVSS 8.8, Botslab G980H)
- [CVE-2026-97326](https://cve.now/CVE-2026-97326.md): songxinjianqwe Chat chat-server ChatServer.java server-side request forgery (CVSS 6.9, songxinjianqwe Chat)
- [CVE-2026-48543](https://cve.now/CVE-2026-48543.md): Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description (CVSS 5.1, krayin laravel-crm)
- [CVE-2026-82566](https://cve.now/CVE-2026-82566.md): Botslab G980H Dashcams Insufficient session expiration (CVSS 8.8, Botslab G980H)
- [CVE-2026-48542](https://cve.now/CVE-2026-48542.md): Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field (CVSS 5.1, krayin laravel-crm)
- [CVE-2026-48541](https://cve.now/CVE-2026-48541.md): Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field (CVSS 5.1, krayin laravel-crm)
- [CVE-2026-97325](https://cve.now/CVE-2026-97325.md): YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect (CVSS 5.3, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-48540](https://cve.now/CVE-2026-48540.md): Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title (CVSS 5.1, krayin laravel-crm)
- [CVE-2026-93291](https://cve.now/CVE-2026-93291.md): Improper certificate validation in Eufy Omni C20 (CVSS 9.3, Eufy Omni C20)
- [CVE-2026-84399](https://cve.now/CVE-2026-84399.md): Botslab G980H Dashcams Incorrect Authorization (CVSS 8.8, Botslab G980H)
- [CVE-2026-93290](https://cve.now/CVE-2026-93290.md): Use of Hard-coded Credentials in Eufy Omni C20 (CVSS 6.8, Eufy Omni C20)
- [CVE-2026-93289](https://cve.now/CVE-2026-93289.md): OS command injection in Eufy Omni C20, Omni X10 Pro (CVSS 9.0, Eufy Omni C20 · Eufy Omni X10 Pro)
- [CVE-2026-97324](https://cve.now/CVE-2026-97324.md): YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization (CVSS 6.9, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-82372](https://cve.now/CVE-2026-82372.md): Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a (CVSS 8.5, Brocade SANnav)
- [CVE-2026-82164](https://cve.now/CVE-2026-82164.md): Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. (CVSS 7.1, Dell Trusted Device Client,)
- [CVE-2026-96883](https://cve.now/CVE-2026-96883.md): Type confusion in AWS pgcollection allows remote code execution (CVSS 8.8, AWS pgcollection)
- [CVE-2026-97323](https://cve.now/CVE-2026-97323.md): YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal (CVSS 5.3, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-89325](https://cve.now/CVE-2026-89325.md): Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation (CVSS 7.8, Rapid7 Insight Agent)
- [CVE-2026-86860](https://cve.now/CVE-2026-86860.md): Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform (CVSS 9.3, ServiceNow AI Platform)
- [CVE-2026-56792](https://cve.now/CVE-2026-56792.md): Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. (CVSS 4.4, Dell Rugged Control Center)
- [CVE-2026-81473](https://cve.now/CVE-2026-81473.md): Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. (CVSS 8.1, Dell Rugged Control Center)
- [CVE-2026-86859](https://cve.now/CVE-2026-86859.md): Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform (CVSS 8.7, ServiceNow AI Platform)
- [CVE-2026-13016](https://cve.now/CVE-2026-13016.md): Unauthenticated SQL Injection in ServiceNow AI Platform (CVSS 9.3, ServiceNow AI Platform)
- [CVE-2026-97322](https://cve.now/CVE-2026-97322.md): YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting (CVSS 5.3, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-81455](https://cve.now/CVE-2026-81455.md): Dell ThinOS 10, versions prior to SecurityAddon\_2605.10.2766\_T10, contain a Missing Authentication for Critical Function vulnerability. (CVSS 8.6, Dell ThinOS)
- [CVE-2026-57440](https://cve.now/CVE-2026-57440.md): Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-86858](https://cve.now/CVE-2026-86858.md): Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform (CVSS 8.7, ServiceNow AI Platform)
- [CVE-2026-82157](https://cve.now/CVE-2026-82157.md): Dell ThinOS 10, versions prior to SecurityAddon\_2605.10.2766\_T10, contains an Improper Certificate Validation vulnerability. (CVSS 8.3, Dell ThinOS)
- [CVE-2026-86857](https://cve.now/CVE-2026-86857.md): Authorization Bypass in ServiceNow AI Platform (CVSS 8.4, ServiceNow AI Platform)
- [CVE-2026-48073](https://cve.now/CVE-2026-48073.md): Docmost: Page export can include restricted same-space attachments through forged attachmentId (CVSS 4.3, docmost)
- [CVE-2026-52853](https://cve.now/CVE-2026-52853.md): Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER (CVSS 5.2, docmost)
- [CVE-2026-61823](https://cve.now/CVE-2026-61823.md): code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute (CVSS 7.3, code16 sharp · code16/sharp)
- [CVE-2026-48072](https://cve.now/CVE-2026-48072.md): Docmost: Public image fileName path traversal leads to unauthorized local file read (CVSS 5.3, docmost)
- [CVE-2026-97321](https://cve.now/CVE-2026-97321.md): YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection (CVSS 5.3, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-52850](https://cve.now/CVE-2026-52850.md): Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces (CVSS 4.3, docmost)
- [CVE-2026-65827](https://cve.now/CVE-2026-65827.md): Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service (CVSS 6.5, docmost)
- [CVE-2026-13248](https://cve.now/CVE-2026-13248.md): Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface (CVSS 8.8, Honeywell PD45 Industrial Printer)
- [CVE-2026-61825](https://cve.now/CVE-2026-61825.md): code16/sharp has a stored XSS via data-html-content Sanitizer Bypass (CVSS 8.7, code16 sharp · code16/sharp)
- [CVE-2026-13249](https://cve.now/CVE-2026-13249.md): Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040 (CVSS 9.8, Honeywell PD45 Industrial Printer)
- [CVE-2026-82371](https://cve.now/CVE-2026-82371.md): Plaintext exposure of sensitive authentication data in SANnav discovery service log files (CVSS 8.5, Brocade SANnav)
- [CVE-2026-96749](https://cve.now/CVE-2026-96749.md): Heap out-of-bounds write via signed size overflow in BSON document encoding (CVSS 7.5, MongoDB Python Driver · pymongo)
- [CVE-2026-96748](https://cve.now/CVE-2026-96748.md): Connection redirection via percent-encoded delimiter injection in connection string hosts (CVSS 8.3, MongoDB Python Driver · pymongo)
- [CVE-2026-96747](https://cve.now/CVE-2026-96747.md): Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption (CVSS 5.3, MongoDB Python Driver · pymongo)
- [CVE-2026-48070](https://cve.now/CVE-2026-48070.md): Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion (CVSS 7.1, docmost)
- [CVE-2026-97320](https://cve.now/CVE-2026-97320.md): YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery (CVSS 5.3, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-62286](https://cve.now/CVE-2026-62286.md): Dozzle label filters do not restrict container event and statistics streams (CVSS 4.3, amir20 dozzle · github.com/amir20/dozzle)
- [CVE-2026-85738](https://cve.now/CVE-2026-85738.md): TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4) (CVSS 6.3, liketrek TREK)
- [CVE-2026-77293](https://cve.now/CVE-2026-77293.md): TREK: Cross-user note-file deletion (IDOR / Broken Access Control) (CVSS 7.1, mauriceboe TREK)
- [CVE-2026-77320](https://cve.now/CVE-2026-77320.md): TREK: Public trip share link ignores the \`share\_map\` permission server-side (client-enforced authorization → itinerary/location disclosure) (CVSS 5.3, mauriceboe TREK)
- [CVE-2026-77321](https://cve.now/CVE-2026-77321.md): TREK MCP trip summary bypasses delegated OAuth read scopes (CVSS 4.3, mauriceboe TREK)
- [CVE-2026-77294](https://cve.now/CVE-2026-77294.md): TREK: Server-Side Request Forgery via User-Configurable LLM Base URL (CVSS 8.1, mauriceboe TREK)
- [CVE-2026-93405](https://cve.now/CVE-2026-93405.md): Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion) (CVSS 6.1, Foundry376 Mailspring)
- [CVE-2026-61816](https://cve.now/CVE-2026-61816.md): zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME (CVSS 7.5, zbateson mail-mime-parser · zbateson/mail-mime-parser)
- [CVE-2026-61815](https://cve.now/CVE-2026-61815.md): zbateson/mail-mime-parser has CRLF header injection via attachment filename (CVSS 7.2, zbateson mail-mime-parser · zbateson/mail-mime-parser)
- [CVE-2026-81508](https://cve.now/CVE-2026-81508.md): ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing (CVSS 4.3, espressif esp-idf)
- [CVE-2026-71540](https://cve.now/CVE-2026-71540.md): Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion (CVSS 7.5, wazuh)
- [CVE-2026-61741](https://cve.now/CVE-2026-61741.md): http4s-scala-xml has an XML External Entity (XXE) processing issue (CVSS 9.3, http4s-scala-xml · org.http4s:http4s-scala-xml\_2.12 +2)
- [CVE-2026-61811](https://cve.now/CVE-2026-61811.md): Wazuh: Unbounded Recursion in os\_xml \`\_getattributes()\` Causes analysisd Worker Thread Stack Exhaustion (CVSS 6.5, wazuh)
- [CVE-2026-61604](https://cve.now/CVE-2026-61604.md): ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass (CVSS 9.3, ixofoundation ixo-blockchain · github.com/ixofoundation/… +6)
- [CVE-2026-61732](https://cve.now/CVE-2026-61732.md): Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context (CVSS 10.0, BitterSecurity Decepticon · BitterSecurity decepticon-co… +4)
- [CVE-2026-63645](https://cve.now/CVE-2026-63645.md): OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials (CVSS 7.5, openobserve)
- [CVE-2026-54461](https://cve.now/CVE-2026-54461.md): Habitica: Regex Injection / ReDoS in Member Search (CVSS 6.5, HabitRPG habitica)
- [CVE-2026-61788](https://cve.now/CVE-2026-61788.md): @bytebase/dbhub's read-only mode does not prevent database writes (CVSS 7.4, bytebase dbhub · @bytebase/dbhub)
- [CVE-2026-61784](https://cve.now/CVE-2026-61784.md): xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS (CVSS 6.1, cstigler node-xhtml-purifier · xhtml-purifier)
- [CVE-2026-85056](https://cve.now/CVE-2026-85056.md): ZITADEL: MFA bypass via session reuse in Login V2 (CVSS 8.2, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-61782](https://cve.now/CVE-2026-61782.md): @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata (CVSS 7.5, web-infra-dev rsdoctor · @rsdoctor/rspack-plugin)
- [CVE-2026-85057](https://cve.now/CVE-2026-85057.md): ZITADEL: Actions V1 sandbox escape: host file read via require() (CVSS 8.7, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-97233](https://cve.now/CVE-2026-97233.md): volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting (CVSS 5.1, volotat Anagnorisis)
- [CVE-2026-61742](https://cve.now/CVE-2026-61742.md): DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution (CVSS 9.3, bytebase dbhub · @bytebase/dbhub)
- [CVE-2026-57179](https://cve.now/CVE-2026-57179.md): social-auth-core has a Session Fixation issue (CVSS 4.2, python-social-auth social-core · social-auth-core)
- [CVE-2026-57178](https://cve.now/CVE-2026-57178.md): social-auth-core: VK App backend accepts unsigned callback data when auth\_key is missing (CVSS 7.4, python-social-auth social-core · social-auth-core)
- [CVE-2026-57177](https://cve.now/CVE-2026-57177.md): social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend (CVSS 4.3, python-social-auth social-core · social-auth-core)
- [CVE-2026-57176](https://cve.now/CVE-2026-57176.md): social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend (CVSS 6.8, python-social-auth social-core · social-auth-core)
- [CVE-2026-57175](https://cve.now/CVE-2026-57175.md): social-auth-core has an Improper Authentication issue (CVSS 6.4, python-social-auth social-core · social-auth-core)
- [CVE-2026-95985](https://cve.now/CVE-2026-95985.md): Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces (CVSS 8.8, Amazon Kiro IDE)
- [CVE-2026-91119](https://cve.now/CVE-2026-91119.md): Discourse: Encode action\_code\_who in mention URLs (CVSS 6.4, discourse)
- [CVE-2026-91121](https://cve.now/CVE-2026-91121.md): Discourse: Chat upload filenames rendered as raw HTML in excerpts (CVSS 5.0, discourse)
- [CVE-2026-97232](https://cve.now/CVE-2026-97232.md): volotat Anagnorisis page.html start\_streaming path traversal (CVSS 5.3, volotat Anagnorisis)
- [CVE-2026-91120](https://cve.now/CVE-2026-91120.md): Discourse: Stored HTML injection in video notification emails (CVSS 5.4, discourse)
- [CVE-2026-91132](https://cve.now/CVE-2026-91132.md): Discourse: Wildcard iframe origin allowlist bypass via authority separators (CVSS 4.3, discourse)
- [CVE-2026-91122](https://cve.now/CVE-2026-91122.md): Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users (CVSS 8.7, discourse)
- [CVE-2026-56744](https://cve.now/CVE-2026-56744.md): \`@bsv/wallet-toolbox\` / \`-client\` / \`-mobile\` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage) (CVSS 8.7, bsv-blockchain @bsv/wallet-toolbox · bsv-blockchain @bsv… +4)
- [CVE-2026-91123](https://cve.now/CVE-2026-91123.md): Discourse: Reject literal backslash path separators in iframe src traversal guard (CVSS 7.2, discourse)
- [CVE-2026-91133](https://cve.now/CVE-2026-91133.md): Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure (CVSS 6.5, discourse)
- [CVE-2026-91134](https://cve.now/CVE-2026-91134.md): Discourse: Block post iframes whose encoded userinfo bypasses the allowed\_iframes allowlist (CVSS 5.4, discourse)
- [CVE-2026-84302](https://cve.now/CVE-2026-84302.md): Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables (CVSS 4.2, discourse)
- [CVE-2026-26054](https://cve.now/CVE-2026-26054.md): SumatraPDF: Heap out-of-bounds read in MOBI header parser. (CVSS 6.8, sumatrapdfreader sumatrapdf)
- [CVE-2026-91161](https://cve.now/CVE-2026-91161.md): OpenWA: VIEWER API keys can read WhatsApp group invite codes (CVSS 6.4, rmyndharis OpenWA)
- [CVE-2026-97231](https://cve.now/CVE-2026-97231.md): volotat Anagnorisis Socket.IO Connect app.py missing authentication (CVSS 6.9, volotat Anagnorisis)
- [CVE-2026-91160](https://cve.now/CVE-2026-91160.md): OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream (CVSS 8.2, rmyndharis OpenWA)
- [CVE-2026-62368](https://cve.now/CVE-2026-62368.md): Snipe-IT: Stored XSS via Custom Field name in asset-list column headers (CVSS 8.1, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-63493](https://cve.now/CVE-2026-63493.md): Snipe-IT: 2FA bypass via the API token flow (CVSS 8.6, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-47132](https://cve.now/CVE-2026-47132.md): phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration (CVSS 5.4, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2026-56738](https://cve.now/CVE-2026-56738.md): phpMyFAQ has SQL Injection in \`StopWords::add()\` — Unescaped Stop Word Insertion (CVSS 8.5, thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1)
- [CVE-2026-63498](https://cve.now/CVE-2026-63498.md): Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API (CVSS 8.7, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-94281](https://cve.now/CVE-2026-94281.md): Out-of-bounds read in libXi's XListInputDevices() class parsing (CVSS 6.5, x.org libXi)
- [CVE-2026-94606](https://cve.now/CVE-2026-94606.md): authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage (CVSS 8.9, goauthentik authentik · authentik)
- [CVE-2026-94609](https://cve.now/CVE-2026-94609.md): authentik: Privilege Escalation to Superuser via Group Hierarchy (CVSS 8.8, goauthentik authentik · authentik)
- [CVE-2026-93545](https://cve.now/CVE-2026-93545.md): Out-of-bounds read in libXi's XListInputDevices() (CVSS 6.5, x.org libXi)
- [CVE-2026-94611](https://cve.now/CVE-2026-94611.md): authentik: Stored credentials are readable with view permission alone (CVSS 8.1, goauthentik authentik · authentik)
- [CVE-2026-94612](https://cve.now/CVE-2026-94612.md): authentik: Authentication bypass via assertion confusion in SAML sources (CVSS 7.4, goauthentik authentik · authentik)
- [CVE-2026-93544](https://cve.now/CVE-2026-93544.md): Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing (CVSS 6.5, x.org libXi)
- [CVE-2026-94613](https://cve.now/CVE-2026-94613.md): authentik: Denial of Service via Document Type Declarations in SAML Messages (CVSS 7.5, goauthentik authentik · authentik)
- [CVE-2026-93543](https://cve.now/CVE-2026-93543.md): Out-of-bounds read in libXi's XI2 class parser (CVSS 7.4, x.org libXi)
- [CVE-2026-79763](https://cve.now/CVE-2026-79763.md): Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749) (CVSS 5.3, Termix-SSH Termix)
- [CVE-2026-97521](https://cve.now/CVE-2026-97521.md): gfs2: fix quota init duplicate scan (no CVSS, Linux)
- [CVE-2026-97520](https://cve.now/CVE-2026-97520.md): gfs2: move quota\_init qc iterator increment (CVSS 7.1, Linux)
- [CVE-2026-97519](https://cve.now/CVE-2026-97519.md): drm/xe: Fix null pointer dereference in devcoredump cleanup (no CVSS, Linux)
- [CVE-2026-97518](https://cve.now/CVE-2026-97518.md): wifi: cfg80211: reject duplicate wiphy cipher suite entries (no CVSS, Linux)
- [CVE-2026-97517](https://cve.now/CVE-2026-97517.md): wifi: nl80211: reject beacons with bad HE operation (no CVSS, Linux)
- [CVE-2026-97516](https://cve.now/CVE-2026-97516.md): wifi: rtw88: Add NULL check for chip-\>edcca\_th in rtw\_fw\_adaptivity\_result() (no CVSS, Linux)
- [CVE-2026-97515](https://cve.now/CVE-2026-97515.md): i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 (no CVSS, Linux)
- [CVE-2026-97514](https://cve.now/CVE-2026-97514.md): media: chips-media: wave5: Fix Reports from Kernel Lock Validator (no CVSS, Linux)
- [CVE-2026-97513](https://cve.now/CVE-2026-97513.md): media: chips-media: wave5: Release m2m\_ctx after Instance Removed from List (CVSS 7.8, Linux)
- [CVE-2026-97512](https://cve.now/CVE-2026-97512.md): spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (no CVSS, Linux)
- [CVE-2026-97511](https://cve.now/CVE-2026-97511.md): wifi: mac80211: avoid out-of-bounds access in monitor (no CVSS, Linux)
- [CVE-2026-97510](https://cve.now/CVE-2026-97510.md): thunderbolt: Release request if tb\_cfg\_request() fails in \_\_tb\_xdomain\_response() (no CVSS, Linux)
- [CVE-2026-97509](https://cve.now/CVE-2026-97509.md): thunderbolt: Keep XDomain reference during the lifetime of a service (CVSS 8.8, Linux)
- [CVE-2026-97508](https://cve.now/CVE-2026-97508.md): thunderbolt: Set tb-\>root\_switch to NULL when domain is stopped (CVSS 7.5, Linux)
- [CVE-2026-97507](https://cve.now/CVE-2026-97507.md): media: dm1105: fix missing error check for dma\_alloc\_coherent (no CVSS, Linux)
- [CVE-2026-97506](https://cve.now/CVE-2026-97506.md): crypto: ixp4xx - fix buffer chain unwind on allocation failure (no CVSS, Linux)
- [CVE-2026-97505](https://cve.now/CVE-2026-97505.md): PCI/sysfs: Add CAP\_SYS\_ADMIN check to \_\_resource\_resize\_store() (no CVSS, Linux)
- [CVE-2026-97504](https://cve.now/CVE-2026-97504.md): watchdog: lenovo\_se10\_wdt: Fix use-after-free and resource leak risk (no CVSS, Linux)
- [CVE-2026-97503](https://cve.now/CVE-2026-97503.md): genirq/proc: Size interrupt directory names for 10-digit interrupt numbers (no CVSS, Linux)
- [CVE-2026-97502](https://cve.now/CVE-2026-97502.md): mmc: davinci: avoid NULL deref of host-\>data in IRQ handler (no CVSS, Linux)
- [CVE-2026-97501](https://cve.now/CVE-2026-97501.md): pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction (no CVSS, Linux)
- [CVE-2026-97500](https://cve.now/CVE-2026-97500.md): wifi: rtw89: phy: check length before parsing PHY status IE (no CVSS, Linux)
- [CVE-2026-97499](https://cve.now/CVE-2026-97499.md): coresight: perf: Retrieve path and source from event data (no CVSS, Linux)
- [CVE-2026-97498](https://cve.now/CVE-2026-97498.md): drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction (no CVSS, Linux)
- [CVE-2026-97497](https://cve.now/CVE-2026-97497.md): drm/amdkfd: Check bounds for allocate\_sdma\_queue restore\_sdma\_id (CVSS 7.8, Linux)
- [CVE-2026-97496](https://cve.now/CVE-2026-97496.md): drm/amdkfd: Fix OOB memory exposure in get\_wave\_state() (CVSS 7.1, Linux)
- [CVE-2026-97495](https://cve.now/CVE-2026-97495.md): drm/amdkfd: Check bounds on allocate\_doorbell (no CVSS, Linux)
- [CVE-2026-97494](https://cve.now/CVE-2026-97494.md): drm/amdgpu: validate and share PSP fw\_pri\_buf copies via psp\_copy\_fw (no CVSS, Linux)
- [CVE-2026-97493](https://cve.now/CVE-2026-97493.md): drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (no CVSS, Linux)
- [CVE-2026-97492](https://cve.now/CVE-2026-97492.md): wifi: mac80211: don't call ieee80211\_handle\_reconfig\_failure when not needed (no CVSS, Linux)
- [CVE-2026-97491](https://cve.now/CVE-2026-97491.md): net/rds: Don't sleep inside rds\_ib\_conn\_path\_shutdown (no CVSS, Linux)
- [CVE-2026-97490](https://cve.now/CVE-2026-97490.md): affs: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-97489](https://cve.now/CVE-2026-97489.md): bfs: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-97488](https://cve.now/CVE-2026-97488.md): qnx4: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-97487](https://cve.now/CVE-2026-97487.md): jfs: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-97486](https://cve.now/CVE-2026-97486.md): hpfs: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-97485](https://cve.now/CVE-2026-97485.md): omfs: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-97484](https://cve.now/CVE-2026-97484.md): usbip: vhci\_hcd: fix NULL deref in status\_show\_vhci (no CVSS, Linux)
- [CVE-2026-97483](https://cve.now/CVE-2026-97483.md): usb: core: hcd: fix possible deadlock in rh control transfers (no CVSS, Linux)
- [CVE-2026-97482](https://cve.now/CVE-2026-97482.md): usb: gadget: goku\_udc: avoid NULL deref of dev-\>driver in INT\_USBRESET log (no CVSS, Linux)
- [CVE-2026-97481](https://cve.now/CVE-2026-97481.md): serial: 8250: fix possible ISR soft lockup (no CVSS, Linux)
- [CVE-2026-97480](https://cve.now/CVE-2026-97480.md): tty: serial: 8250: protect against NULL uart-\>port.dev in register (no CVSS, Linux)
- [CVE-2026-97479](https://cve.now/CVE-2026-97479.md): driver core: Avoid warning when removing a device while its supplier is unbinding (no CVSS, Linux)
- [CVE-2026-97478](https://cve.now/CVE-2026-97478.md): virt: acrn: Fix irqfd use-after-free during eventfd shutdown (CVSS 7.8, Linux)
- [CVE-2026-97477](https://cve.now/CVE-2026-97477.md): RDMA/counter: Fix num\_counters leak on bind\_qp failure in alloc\_and\_bind() (no CVSS, Linux)
- [CVE-2026-97476](https://cve.now/CVE-2026-97476.md): rds: filter RDS\_INFO\_\* getsockopt by caller's netns (no CVSS, Linux)
- [CVE-2026-97475](https://cve.now/CVE-2026-97475.md): thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (no CVSS, Linux)
- [CVE-2026-97474](https://cve.now/CVE-2026-97474.md): wifi: iwlwifi: mld: purge async notifications upon nic error (CVSS 7.4, Linux)
- [CVE-2026-97473](https://cve.now/CVE-2026-97473.md): powercap: intel\_rapl: Fix memory leak in rapl\_add\_package\_cpuslocked() (no CVSS, Linux)
- [CVE-2026-97472](https://cve.now/CVE-2026-97472.md): ipv6: addrconf: fix temp address generation after prefix deprecation (no CVSS, Linux)
- [CVE-2026-97456](https://cve.now/CVE-2026-97456.md): ACPICA: Fix condition check in acpi\_ps\_parse\_loop() (no CVSS, Linux)
- [CVE-2026-97455](https://cve.now/CVE-2026-97455.md): ACPICA: Fix use-after-free in acpi\_ds\_terminate\_control\_method() (CVSS 8.4, Linux)
- [CVE-2026-97454](https://cve.now/CVE-2026-97454.md): ACPICA: add boundary checks in acpi\_ps\_get\_next\_field() (CVSS 7.7, Linux)
- [CVE-2026-97453](https://cve.now/CVE-2026-97453.md): ACPICA: validate byte\_count in acpi\_ps\_get\_next\_package\_length() (no CVSS, Linux)
- [CVE-2026-97452](https://cve.now/CVE-2026-97452.md): ACPICA: Prevent adding invalid references (CVSS 8.4, Linux)
- [CVE-2026-97451](https://cve.now/CVE-2026-97451.md): ACPICA: Fix integer overflow in acpi\_ex\_opcode\_3A\_1T\_1R() (mid\_op) (CVSS 8.4, Linux)
- [CVE-2026-97450](https://cve.now/CVE-2026-97450.md): ACPICA: validate handler object type in two places (CVSS 8.4, Linux)
- [CVE-2026-97449](https://cve.now/CVE-2026-97449.md): ACPICA: Add package limit checks in parser functions (no CVSS, Linux)
- [CVE-2026-97448](https://cve.now/CVE-2026-97448.md): ACPICA: Add validation for node in acpi\_ns\_build\_normalized\_path() (CVSS 7.7, Linux)
- [CVE-2026-97447](https://cve.now/CVE-2026-97447.md): ACPICA: Enhance OEM ID and Table ID validation in acpi\_ex\_load\_table\_op() (no CVSS, Linux)
- [CVE-2026-97446](https://cve.now/CVE-2026-97446.md): ACPICA: Fix NULL pointer dereference in acpi\_ns\_custom\_package() (no CVSS, Linux)
- [CVE-2026-97445](https://cve.now/CVE-2026-97445.md): ACPICA: Enhance buffer validation in acpi\_ut\_walk\_aml\_resources() (CVSS 7.7, Linux)
- [CVE-2026-97444](https://cve.now/CVE-2026-97444.md): ACPICA: add boundary checks in two places (CVSS 7.7, Linux)
- [CVE-2026-97443](https://cve.now/CVE-2026-97443.md): perf/ftrace: Fix WARNING in \_\_unregister\_ftrace\_function (no CVSS, Linux)
- [CVE-2026-97442](https://cve.now/CVE-2026-97442.md): wifi: ath11k: fix invalid data access in ath11k\_dp\_rx\_h\_undecap\_nwifi (CVSS 8.8, Linux)
- [CVE-2026-97441](https://cve.now/CVE-2026-97441.md): ata: ahci: fail probe if BAR too small for claimed ports (no CVSS, Linux)
- [CVE-2026-97440](https://cve.now/CVE-2026-97440.md): net: qrtr: fix node refcount leak on ctrl packet alloc failure (no CVSS, Linux)
- [CVE-2026-97439](https://cve.now/CVE-2026-97439.md): fs/ntfs3: preserve non-DOS attribute bits in system.dos\_attrib (no CVSS, Linux)
- [CVE-2026-97438](https://cve.now/CVE-2026-97438.md): fs/ntfs3: validate index entry key bounds (CVSS 7.1, Linux)
- [CVE-2026-97437](https://cve.now/CVE-2026-97437.md): ntfs3: fix out-of-bounds read in ntfs\_dir\_emit() and hdr\_find\_e() (CVSS 7.1, Linux)
- [CVE-2026-97436](https://cve.now/CVE-2026-97436.md): dpaa2-switch: rework FDB management on the bridge leave path (no CVSS, Linux)
- [CVE-2026-97435](https://cve.now/CVE-2026-97435.md): net: dsa: sja1105: flower: reject cross-chip redirect (no CVSS, Linux)
- [CVE-2026-97434](https://cve.now/CVE-2026-97434.md): dpaa2-switch: fix handling of NAPI on the remove path (no CVSS, Linux)
- [CVE-2026-97433](https://cve.now/CVE-2026-97433.md): nvme: validate FDP configuration descriptor sizes (CVSS 8.2, Linux)
- [CVE-2026-97432](https://cve.now/CVE-2026-97432.md): wifi: iwlwifi: mvm: fix P2P-Device binding handling (no CVSS, Linux)
- [CVE-2026-97431](https://cve.now/CVE-2026-97431.md): drm/amd/display: Avoid DPMS-on for phantom stream (no CVSS, Linux)
- [CVE-2026-97430](https://cve.now/CVE-2026-97430.md): xhci: Prevent queuing new commands if xhci is inaccessible (no CVSS, Linux)
- [CVE-2026-97429](https://cve.now/CVE-2026-97429.md): drm/amdkfd: fix UAF race in destroy\_queue\_cpsch (CVSS 7.8, Linux)
- [CVE-2026-97428](https://cve.now/CVE-2026-97428.md): drm/amdgpu: harden FRU PIA parsing with bounded helpers (CVSS 7.7, Linux)
- [CVE-2026-97427](https://cve.now/CVE-2026-97427.md): drm/amd/pm: bound pp\_dpm\_set\_pp\_table() memcpy (no CVSS, Linux)
- [CVE-2026-97426](https://cve.now/CVE-2026-97426.md): drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error (no CVSS, Linux)
- [CVE-2026-97425](https://cve.now/CVE-2026-97425.md): drm/amdgpu: fix buffer overflow during vBIOS update (no CVSS, Linux)
- [CVE-2026-97424](https://cve.now/CVE-2026-97424.md): drm/amdgpu/ras: add ras\_suspend callback and use it for cp\_ecc\_error\_irq (no CVSS, Linux)
- [CVE-2026-97423](https://cve.now/CVE-2026-97423.md): cxl/region: Validate partition index before array access (no CVSS, Linux)
- [CVE-2026-97422](https://cve.now/CVE-2026-97422.md): drm/amdkfd: fix SMI event cross-process information leak (no CVSS, Linux)
- [CVE-2026-97421](https://cve.now/CVE-2026-97421.md): RDMA/umem: Be careful about boundary conditions in ib\_umem\_find\_best\_pgsz() (CVSS 7.8, Linux)
- [CVE-2026-97420](https://cve.now/CVE-2026-97420.md): bpf: NUL-terminate replaced sysctl value (no CVSS, Linux)
- [CVE-2026-97419](https://cve.now/CVE-2026-97419.md): hsr: broadcast netlink notifications in the device's net namespace (no CVSS, Linux)
- [CVE-2026-97418](https://cve.now/CVE-2026-97418.md): ALSA: es18xx: check control allocation before private data setup (no CVSS, Linux)
- [CVE-2026-97417](https://cve.now/CVE-2026-97417.md): netfilter: nf\_conntrack: use get\_unaligned\_be32() in tcp\_sack() (CVSS 7.5, Linux)
- [CVE-2026-97416](https://cve.now/CVE-2026-97416.md): btrfs: balance: fix potential bg lookup failure in btrfs\_may\_alloc\_data\_chunk() (no CVSS, Linux)
- [CVE-2026-97415](https://cve.now/CVE-2026-97415.md): btrfs: tree-checker: validate names in ROOT\_REF and ROOT\_BACKREF (CVSS 7.8, Linux)
- [CVE-2026-97414](https://cve.now/CVE-2026-97414.md): ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365\_afe\_suspend() (no CVSS, Linux)
- [CVE-2026-97413](https://cve.now/CVE-2026-97413.md): RDMA/rtrs-srv: Fix integer underflow in process\_read and process\_write (CVSS 9.8, Linux)
- [CVE-2026-97412](https://cve.now/CVE-2026-97412.md): pds\_core: quiesce DMA before freeing resources (no CVSS, Linux)
- [CVE-2026-97411](https://cve.now/CVE-2026-97411.md): net: ibm: emac: mal: fix potential system hang in mal\_remove() (no CVSS, Linux)
- [CVE-2026-97410](https://cve.now/CVE-2026-97410.md): netconsole: take target\_cleanup\_list\_lock in drop\_netconsole\_target() (no CVSS, Linux)
- [CVE-2026-97409](https://cve.now/CVE-2026-97409.md): nvme-fc: Do not cancel requests in io target before it is initialized (CVSS 8.8, Linux)
- [CVE-2026-97408](https://cve.now/CVE-2026-97408.md): Bluetooth: L2CAP: validate connectionless PSM length (no CVSS, Linux)
- [CVE-2026-97407](https://cve.now/CVE-2026-97407.md): ASoC: rockchip: rockchip\_pdm: Handle runtime PM resume failures in set\_fmt (no CVSS, Linux)
- [CVE-2026-93830](https://cve.now/CVE-2026-93830.md): net: stmmac: xgmac2: disable RBUE in default RX interrupt mask (CVSS 7.5, Linux)
- [CVE-2026-93829](https://cve.now/CVE-2026-93829.md): smb: client: fix races in cifsd thread creation (no CVSS, Linux)
- [CVE-2026-93828](https://cve.now/CVE-2026-93828.md): exfat: fix handling of damaged volume in exfat\_create\_upcase\_table() (no CVSS, Linux)
- [CVE-2026-93827](https://cve.now/CVE-2026-93827.md): virtio-fs: avoid double-free on failed queue setup (CVSS 8.4, Linux)
- [CVE-2026-93826](https://cve.now/CVE-2026-93826.md): HID: hidpp: fix potential UAF in hidpp\_connect\_event() (CVSS 7.5, Linux)
- [CVE-2026-93825](https://cve.now/CVE-2026-93825.md): spi: Add NULL check for spi\_get\_device\_id() in spi\_get\_device\_match\_data() (no CVSS, Linux)
- [CVE-2026-93824](https://cve.now/CVE-2026-93824.md): tls: reject the combination of TLS and sockmap (no CVSS, Linux)
- [CVE-2026-93823](https://cve.now/CVE-2026-93823.md): drm/amdkfd: Let driver decide buffer size at AMDKFD\_IOC\_GET\_DMABUF\_INFO ioctl (no CVSS, Linux)
- [CVE-2026-93822](https://cve.now/CVE-2026-93822.md): PCI: iproc: Protect root bus removal with rescan lock (no CVSS, Linux)
- [CVE-2026-93542](https://cve.now/CVE-2026-93542.md): Out-of-bounds read in libXi's XI2 class parsing via size\_classes() and copy\_classes() (CVSS 6.5, x.org libXi)
- [CVE-2026-93821](https://cve.now/CVE-2026-93821.md): PCI: altera: Protect root bus removal with rescan lock (no CVSS, Linux)
- [CVE-2026-93820](https://cve.now/CVE-2026-93820.md): PCI: rockchip: Protect root bus removal with rescan lock (no CVSS, Linux)
- [CVE-2026-93819](https://cve.now/CVE-2026-93819.md): PCI: mediatek: Protect root bus removal with rescan lock (no CVSS, Linux)
- [CVE-2026-93818](https://cve.now/CVE-2026-93818.md): PCI: plda: Protect root bus removal with rescan lock (no CVSS, Linux)
- [CVE-2026-93817](https://cve.now/CVE-2026-93817.md): perf: Fix addr\_filter\_ranges lifetime (CVSS 7.8, Linux)
- [CVE-2026-93816](https://cve.now/CVE-2026-93816.md): f2fs: validate inline dentry name lengths before conversion (CVSS 7.1, Linux)
- [CVE-2026-93815](https://cve.now/CVE-2026-93815.md): net: au1000: move free\_irq out of the close-time spinlocked section (no CVSS, Linux)
- [CVE-2026-93814](https://cve.now/CVE-2026-93814.md): spi: core: Abort active target transfer on controller suspend (no CVSS, Linux)
- [CVE-2026-93813](https://cve.now/CVE-2026-93813.md): btrfs: tree-checker: validate INODE\_REF's namelen (CVSS 7.8, Linux)
- [CVE-2026-93812](https://cve.now/CVE-2026-93812.md): ksmbd: fix sd\_ndr.data memory leak in ksmbd\_vfs\_set\_sd\_xattr (no CVSS, Linux)
- [CVE-2026-79764](https://cve.now/CVE-2026-79764.md): Termix: Authenticated SSRF via \`/homepage/proxy\` — No Destination Allowlist (CVSS 7.7, Termix-SSH Termix)
- [CVE-2026-93811](https://cve.now/CVE-2026-93811.md): ksmbd: Fix acl.sd\_buf memory leak and invalid sd\_size error handling (no CVSS, Linux)
- [CVE-2026-93810](https://cve.now/CVE-2026-93810.md): cachefiles: Fix double fput (CVSS 7.0, Linux)
- [CVE-2026-93809](https://cve.now/CVE-2026-93809.md): drm/amdgpu: flush pending RCU callbacks on module unload (no CVSS, Linux)
- [CVE-2026-93808](https://cve.now/CVE-2026-93808.md): ALSA: usb-audio: caiaq: validate EP1 reply lengths (no CVSS, Linux)
- [CVE-2026-93807](https://cve.now/CVE-2026-93807.md): wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (no CVSS, Linux)
- [CVE-2026-93806](https://cve.now/CVE-2026-93806.md): wifi: cfg80211: validate assoc response length before status and IE access (CVSS 8.8, Linux)
- [CVE-2026-93805](https://cve.now/CVE-2026-93805.md): wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (no CVSS, Linux)
- [CVE-2026-93804](https://cve.now/CVE-2026-93804.md): wifi: mac80211: ibss: wait for in-flight TX on disconnect (no CVSS, Linux)
- [CVE-2026-93803](https://cve.now/CVE-2026-93803.md): wifi: libipw: fix key index receive bound checks (no CVSS, Linux)
- [CVE-2026-93802](https://cve.now/CVE-2026-93802.md): wifi: rsi: validate beacon length before fixed buffer copy (no CVSS, Linux)
- [CVE-2026-93801](https://cve.now/CVE-2026-93801.md): smb/client: zero-initialize stack-allocated cifs\_open\_info\_data (CVSS 7.0, Linux)
- [CVE-2026-93800](https://cve.now/CVE-2026-93800.md): btrfs: fix use-after-free on reloc root after error in insert\_dirty\_subvol() (no CVSS, Linux)
- [CVE-2026-93799](https://cve.now/CVE-2026-93799.md): wifi: iwlwifi: mvm: validate sta\_id in BA window status notif (CVSS 8.8, Linux)
- [CVE-2026-93798](https://cve.now/CVE-2026-93798.md): btrfs: fix reloc root cleanup in merge\_reloc\_roots() (CVSS 7.8, Linux)
- [CVE-2026-93797](https://cve.now/CVE-2026-93797.md): wifi: iwlwifi: mvm: fix an off-by-1 boundary check (no CVSS, Linux)
- [CVE-2026-93796](https://cve.now/CVE-2026-93796.md): wifi: iwlwifi: pcie: null RX pointers after free (CVSS 7.0, Linux)
- [CVE-2026-93795](https://cve.now/CVE-2026-93795.md): blk-cgroup: fix leaks and online flag on radix\_tree\_insert failure (no CVSS, Linux)
- [CVE-2026-93794](https://cve.now/CVE-2026-93794.md): smb/client: flush dirty data before punching a hole (no CVSS, Linux)
- [CVE-2026-93793](https://cve.now/CVE-2026-93793.md): wifi: iwlwifi: mvm: validate TX\_CMD response layout (CVSS 8.8, Linux)
- [CVE-2026-93792](https://cve.now/CVE-2026-93792.md): wifi: iwlwifi: mvm: fix a possible underflow (no CVSS, Linux)
- [CVE-2026-93791](https://cve.now/CVE-2026-93791.md): wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (no CVSS, Linux)
- [CVE-2026-93790](https://cve.now/CVE-2026-93790.md): wifi: iwlwifi: mvm: fix out-of-bounds tid\_data access in BA notif (CVSS 8.8, Linux)
- [CVE-2026-93789](https://cve.now/CVE-2026-93789.md): wifi: iwlwifi: bound aligned TLV advance in FW parser (no CVSS, Linux)
- [CVE-2026-93788](https://cve.now/CVE-2026-93788.md): wifi: iwlwifi: acpi: validate WGDS table revision index (no CVSS, Linux)
- [CVE-2026-93787](https://cve.now/CVE-2026-93787.md): smb: client: bound dirent name against end of SMB response in cifs\_filldir (CVSS 8.1, Linux)
- [CVE-2026-93786](https://cve.now/CVE-2026-93786.md): ksmbd: preserve VFS inherited POSIX ACL mask (CVSS 8.1, Linux)
- [CVE-2026-93785](https://cve.now/CVE-2026-93785.md): cifs: validate idmap key payload length (no CVSS, Linux)
- [CVE-2026-93784](https://cve.now/CVE-2026-93784.md): wifi: cfg80211: validate IEs in cfg80211\_wext\_siwgenie() (no CVSS, Linux)
- [CVE-2026-93783](https://cve.now/CVE-2026-93783.md): Bluetooth: RFCOMM: validate skb length in rfcomm\_recv\_frame (no CVSS, Linux)
- [CVE-2026-93782](https://cve.now/CVE-2026-93782.md): vhost-scsi: flush backend after device ioctls (CVSS 7.8, Linux)
- [CVE-2026-93781](https://cve.now/CVE-2026-93781.md): scsi: core: Do not block on tag allocation in scsi\_eh\_lock\_door() (no CVSS, Linux)
- [CVE-2026-93288](https://cve.now/CVE-2026-93288.md): netfilter: nfnetlink\_log: wait for rcu grace period before freeing pernet state (CVSS 7.8, Linux)
- [CVE-2026-93287](https://cve.now/CVE-2026-93287.md): i2c: smbus: reject oversized block transfers in the common path (CVSS 7.8, Linux)
- [CVE-2026-93286](https://cve.now/CVE-2026-93286.md): net: appletalk: fix NULL pointer dereference in aarp\_send\_ddp() (no CVSS, Linux)
- [CVE-2026-93285](https://cve.now/CVE-2026-93285.md): f2fs: embed f2fs\_gc\_kthread in f2fs\_sb\_info (no CVSS, Linux)
- [CVE-2026-93284](https://cve.now/CVE-2026-93284.md): drm/pagemap: dma-unmap pages before handling migration errors (CVSS 8.8, Linux)
- [CVE-2026-79762](https://cve.now/CVE-2026-79762.md): Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy (CVSS 5.5, Termix-SSH Termix)
- [CVE-2026-79766](https://cve.now/CVE-2026-79766.md): Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email (CVSS 9.1, Termix-SSH Termix)
- [CVE-2026-79759](https://cve.now/CVE-2026-79759.md): Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint (CVSS 4.3, Termix-SSH Termix)
- [CVE-2026-93541](https://cve.now/CVE-2026-93541.md): Out-of-bounds read in libXi's XQueryDeviceState() (CVSS 6.5, X.org libXi)
- [CVE-2026-79761](https://cve.now/CVE-2026-79761.md): Termix: Command injection in SSH key deployment verification (CVSS 6.6, Termix-SSH Termix)
- [CVE-2026-79758](https://cve.now/CVE-2026-79758.md): Termix: Authenticated users can read other users' host status and clear global SSH connections (CVSS 5.4, Termix-SSH Termix)
- [CVE-2026-75907](https://cve.now/CVE-2026-75907.md): CVE-2026-75907 (CVSS 7.5, Norwegian Cruise Line door access control)
- [CVE-2026-93283](https://cve.now/CVE-2026-93283.md): i3c: master: Fix device\_register() error path (no CVSS, Linux)
- [CVE-2026-93282](https://cve.now/CVE-2026-93282.md): ksmbd: fix maximum allowed access checks (CVSS 8.1, Linux)
- [CVE-2026-93281](https://cve.now/CVE-2026-93281.md): wifi: rtw89: fix HE extended capability length check (no CVSS, Linux)
- [CVE-2026-93280](https://cve.now/CVE-2026-93280.md): greybus: audio: bound the topology section sizes against the fetched size (CVSS 8.8, Linux)
- [CVE-2026-93279](https://cve.now/CVE-2026-93279.md): staging: octeon: add missing tasklet\_kill in cvm\_oct\_tx\_shutdown (no CVSS, Linux)
- [CVE-2026-93278](https://cve.now/CVE-2026-93278.md): staging: octeon: add missing napi\_disable in cvm\_oct\_rx\_shutdown (no CVSS, Linux)
- [CVE-2026-93277](https://cve.now/CVE-2026-93277.md): RDMA/bnxt\_re: Validate udata before executing commands (CVSS 7.8, Linux)
- [CVE-2026-93276](https://cve.now/CVE-2026-93276.md): phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator (no CVSS, Linux)
- [CVE-2026-93275](https://cve.now/CVE-2026-93275.md): perf/x86/intel/pt: Fix stop/start with no update (no CVSS, Linux)
- [CVE-2026-93274](https://cve.now/CVE-2026-93274.md): pinctrl: bcm2835: Don't remove an unregistered GPIO chip (no CVSS, Linux)
- [CVE-2026-93273](https://cve.now/CVE-2026-93273.md): regulator: tps6594: Fix device node reference leaks in multiphase loop (no CVSS, Linux)
- [CVE-2026-93272](https://cve.now/CVE-2026-93272.md): remoteproc: qcom\_wcnss: Fix handling the lack of PD regulators in v3 (no CVSS, Linux)
- [CVE-2026-93271](https://cve.now/CVE-2026-93271.md): wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (no CVSS, Linux)
- [CVE-2026-93270](https://cve.now/CVE-2026-93270.md): bpf: Disallow interpreter fallback for BPF\_ADDR\_PERCPU insn (no CVSS, Linux)
- [CVE-2026-93269](https://cve.now/CVE-2026-93269.md): ext4: fix circular lock dependency in ext4\_ext\_migrate (no CVSS, Linux)
- [CVE-2026-93268](https://cve.now/CVE-2026-93268.md): ext4: skip extra isize expansion during mount to prevent deadlock (no CVSS, Linux)
- [CVE-2026-93267](https://cve.now/CVE-2026-93267.md): RDMA/core: Fix potential use after free in uverbs\_free\_dmah() (no CVSS, Linux)
- [CVE-2026-93266](https://cve.now/CVE-2026-93266.md): arm64: RSI: fix field-spanning write warning in attestation token init (no CVSS, Linux)
- [CVE-2026-93265](https://cve.now/CVE-2026-93265.md): PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node (CVSS 7.7, Linux)
- [CVE-2026-93264](https://cve.now/CVE-2026-93264.md): RDMA/efa: Fix PBL chunk length computation (no CVSS, Linux)
- [CVE-2026-93263](https://cve.now/CVE-2026-93263.md): clk: eswin: Zero-initialize stack-allocated clk\_init\_data (no CVSS, Linux)
- [CVE-2026-93262](https://cve.now/CVE-2026-93262.md): md/raid5-ppl: fix use-after-free in ppl\_do\_flush() (CVSS 7.8, Linux)
- [CVE-2026-93261](https://cve.now/CVE-2026-93261.md): locking/lockdep: Fix NULL pointer dereference in \_\_lock\_set\_class() (no CVSS, Linux)
- [CVE-2026-93260](https://cve.now/CVE-2026-93260.md): powerpc/xive: propagate IPI init errors to prevent use-after-free (CVSS 7.4, Linux)
- [CVE-2026-93259](https://cve.now/CVE-2026-93259.md): powerpc/irq: Fix missing r2 clobber in PCREL inline assembly (no CVSS, Linux)
- [CVE-2026-93258](https://cve.now/CVE-2026-93258.md): ocfs2: do not use make\_bad\_inode() in ocfs2\_read\_inode\_block\_full() (no CVSS, Linux)
- [CVE-2026-93257](https://cve.now/CVE-2026-93257.md): block: handle nogenerate/noverify properly in fs-integrity (no CVSS, Linux)
- [CVE-2026-93256](https://cve.now/CVE-2026-93256.md): arm64: hibernate: mask DAIF before restoring hibernated kernel (no CVSS, Linux)
- [CVE-2026-93255](https://cve.now/CVE-2026-93255.md): btrfs: make sure EXTENT\_BUFFER\_READING is cleared under refs\_lock (no CVSS, Linux)
- [CVE-2026-93254](https://cve.now/CVE-2026-93254.md): arm64: entry: Avoid unnecessary local\_irq\_disable() on kernel exit (no CVSS, Linux)
- [CVE-2026-93253](https://cve.now/CVE-2026-93253.md): sched/isolation: Defer freeing of cpumask memblock memory to initcall (no CVSS, Linux)
- [CVE-2026-93252](https://cve.now/CVE-2026-93252.md): ocfs2: fix circular locking dependency in ocfs2\_init\_acl() (no CVSS, Linux)
- [CVE-2026-93251](https://cve.now/CVE-2026-93251.md): ACPI: bus: Introduce acpi\_bus\_get\_primary\_device() (no CVSS, Linux)
- [CVE-2026-96745](https://cve.now/CVE-2026-96745.md): PHP object injection via unsuppressible \_\_pclass class inference in command monitoring events (CVSS 6.3, MongoDB PHP Driver)
- [CVE-2026-96746](https://cve.now/CVE-2026-96746.md): Heap buffer overflow via mid-scan command list growth in client topology monitoring (CVSS 8.3, MongoDB C Driver)
- [CVE-2026-93250](https://cve.now/CVE-2026-93250.md): vxlan: mdb: Fix use-after-free in vxlan\_mdb\_flush() (CVSS 7.8, Linux)
- [CVE-2026-93249](https://cve.now/CVE-2026-93249.md): spi: amlogic-spisg: Make sure clk\_init\_data is fully initialized (no CVSS, Linux)
- [CVE-2026-96750](https://cve.now/CVE-2026-96750.md): Shell script injection via server-supplied database name in Open MongoDB shell (CVSS 7.3, MongoDB Compass)
- [CVE-2026-93248](https://cve.now/CVE-2026-93248.md): drm/xe: don't WARN on kernel job timeout when device already wedged (no CVSS, Linux)
- [CVE-2026-96744](https://cve.now/CVE-2026-96744.md): Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel (CVSS 7.1, Laravel MongoDB)
- [CVE-2026-93247](https://cve.now/CVE-2026-93247.md): Bluetooth: mgmt: fix 'hdev-\>discovery.uuids' NULL dereference (no CVSS, Linux)
- [CVE-2026-93246](https://cve.now/CVE-2026-93246.md): octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity (no CVSS, Linux)
- [CVE-2026-93245](https://cve.now/CVE-2026-93245.md): apparmor: policy\_int make sure list heads are initialized before fail path (no CVSS, Linux)
- [CVE-2026-79760](https://cve.now/CVE-2026-79760.md): Termix: Authenticated blind SSRF through notification channel test endpoints (CVSS 6.4, Termix-SSH Termix)
- [CVE-2026-93425](https://cve.now/CVE-2026-93425.md): Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root (CVSS 9.9, dokploy)
- [CVE-2026-97226](https://cve.now/CVE-2026-97226.md): DbGate files-style Endpoint files.js fs.readFile path traversal (CVSS 5.3, DbGate)
- [CVE-2026-76907](https://cve.now/CVE-2026-76907.md): LaSuite Doc: Public Documents Enumeration (CVSS 6.5, suitenumerique docs)
- [CVE-2026-93244](https://cve.now/CVE-2026-93244.md): drm/sysfb: simpledrm: Improve stride validation (no CVSS, Linux)
- [CVE-2026-93243](https://cve.now/CVE-2026-93243.md): mm/secretmem: properly account locked pages (no CVSS, Linux)
- [CVE-2026-93242](https://cve.now/CVE-2026-93242.md): scsi: qla2xxx: Fix response queue over-consumption in \_\_qla\_consume\_iocb() (no CVSS, Linux)
- [CVE-2026-93241](https://cve.now/CVE-2026-93241.md): memcg: bypass the reclaim and oom killer for dying tasks once oom\_reaper is done (no CVSS, Linux)
- [CVE-2026-93240](https://cve.now/CVE-2026-93240.md): memcg: make the v1 soft limit knob inert (no CVSS, Linux)
- [CVE-2026-93239](https://cve.now/CVE-2026-93239.md): arm64: mm: Fix the lockless page-table walk in show\_pte() (no CVSS, Linux)
- [CVE-2026-93238](https://cve.now/CVE-2026-93238.md): s390/vfio-ap: fix potential use of uninitialized apm\_filtered bitmap (no CVSS, Linux)
- [CVE-2026-93237](https://cve.now/CVE-2026-93237.md): LoongArch: Add DIRECT\_MAP\_PHYSMEM\_END definition (CVSS 7.8, Linux)
- [CVE-2026-63630](https://cve.now/CVE-2026-63630.md): BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests (CVSS 3.4, alam00000 bentopdf)
- [CVE-2026-93236](https://cve.now/CVE-2026-93236.md): media: meson: vdec: fix NULL pointer deref in vdec\_try\_fmt\_common (no CVSS, Linux)
- [CVE-2026-93235](https://cve.now/CVE-2026-93235.md): f2fs: fix to zero post-EOF data when extending file size (no CVSS, Linux)
- [CVE-2026-93234](https://cve.now/CVE-2026-93234.md): drm/gud: validate TV mode names before creating enum property (no CVSS, Linux)
- [CVE-2026-93233](https://cve.now/CVE-2026-93233.md): drm/nouveau/dmem: fix callocated underflow on large folio split (no CVSS, Linux)
- [CVE-2026-93232](https://cve.now/CVE-2026-93232.md): mm/hugetlb: fix boot panic with CONFIG\_DEBUG\_VM and HVO bootmem pages (no CVSS, Linux)
- [CVE-2026-93231](https://cve.now/CVE-2026-93231.md): lockd: fix swapped arguments in nlmsvc\_match\_ip() (no CVSS, Linux)
- [CVE-2026-93230](https://cve.now/CVE-2026-93230.md): mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier (no CVSS, Linux)
- [CVE-2026-93229](https://cve.now/CVE-2026-93229.md): nfsd: add missing read barrier to rpc\_status\_get dumpit seqcount retry (CVSS 7.1, Linux)
- [CVE-2026-93228](https://cve.now/CVE-2026-93228.md): svcrdma: Reject Write/Reply chunks with segcount 0 (CVSS 9.1, Linux)
- [CVE-2026-93227](https://cve.now/CVE-2026-93227.md): mm/mm\_init: deferred\_grow\_zone(): fix out-of-range first\_deferred\_pfn (no CVSS, Linux)
- [CVE-2026-93226](https://cve.now/CVE-2026-93226.md): ipv6: use RCU iterator to dump route exceptions (no CVSS, Linux)
- [CVE-2026-96873](https://cve.now/CVE-2026-96873.md): Reflected XSS in CirrusSearch debug explain output (CVSS 5.5, The Wikimedia Foundation Mediawiki - CirrusSearch Extension)
- [CVE-2026-77581](https://cve.now/CVE-2026-77581.md): BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass (CVSS 8.6, alam00000 bentopdf)
- [CVE-2025-32000](https://cve.now/CVE-2025-32000.md): Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version. (CVSS 4.3, HCL Software HCL Sametime)
- [CVE-2026-93225](https://cve.now/CVE-2026-93225.md): phy: fsl-imx8mq-usb: fix typec switch leak on probe error path (CVSS 7.4, Linux)
- [CVE-2026-93224](https://cve.now/CVE-2026-93224.md): svcrdma: Fix unmatched rn\_unregister on failed accept (CVSS 8.1, Linux)
- [CVE-2026-93223](https://cve.now/CVE-2026-93223.md): staging: media: tegra-video: fix of\_node\_put() on VIP parse errors (no CVSS, Linux)
- [CVE-2026-93222](https://cve.now/CVE-2026-93222.md): signal: avoid shared siginfo namespace rewrites (no CVSS, Linux)
- [CVE-2026-56739](https://cve.now/CVE-2026-56739.md): Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint (CVSS 8.5, logto-io logto)
- [CVE-2026-63203](https://cve.now/CVE-2026-63203.md): Logto: Account API can disclose stored third-party provider tokens without the identities scope (CVSS 7.6, logto-io logto)
- [CVE-2026-67233](https://cve.now/CVE-2026-67233.md): RabbitMQ: Monitoring-tag user can DELETE shovels (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-93221](https://cve.now/CVE-2026-93221.md): nfsd: convert nfsd\_net boolean flags to unsigned long flags word (CVSS 8.1, Linux)
- [CVE-2026-93220](https://cve.now/CVE-2026-93220.md): sched\_ext: Keep kick\_sync waiting on the rq's own CPU (no CVSS, Linux)
- [CVE-2026-93219](https://cve.now/CVE-2026-93219.md): clocksource/drivers/timer-sun4i: Advertise a real minimum delta (no CVSS, Linux)
- [CVE-2026-93218](https://cve.now/CVE-2026-93218.md): mm/huge\_memory: skip device-private PMDs in madvise\_free\_huge\_pmd (no CVSS, Linux)
- [CVE-2026-93217](https://cve.now/CVE-2026-93217.md): mm/madvise: skip device-private PMDs in cold and pageout walks (no CVSS, Linux)
- [CVE-2026-93216](https://cve.now/CVE-2026-93216.md): mm/page\_owner: use memcg\_data snapshot to avoid TOCTOU in print\_page\_owner\_memcg() (no CVSS, Linux)
- [CVE-2026-93215](https://cve.now/CVE-2026-93215.md): cdx: Fix double free when sysfs file creation fails (no CVSS, Linux)
- [CVE-2026-93214](https://cve.now/CVE-2026-93214.md): usb: gadget: f\_tcm: fix deadlock in usbg\_make\_tpg() (no CVSS, Linux)
- [CVE-2026-93213](https://cve.now/CVE-2026-93213.md): of: fix out-of-bounds read in of\_alias\_scan() stem parser (no CVSS, Linux)
- [CVE-2026-93212](https://cve.now/CVE-2026-93212.md): nfsd: guard nfsd\_serv deref in nfsd\_file\_net\_dispose (no CVSS, Linux)
- [CVE-2026-93211](https://cve.now/CVE-2026-93211.md): nfsd: initialize DRC hash table before registering shrinker (no CVSS, Linux)
- [CVE-2026-93210](https://cve.now/CVE-2026-93210.md): smb: client: harden DFS cache against invalid target hints (no CVSS, Linux)
- [CVE-2026-93209](https://cve.now/CVE-2026-93209.md): Bluetooth: hci\_core: use skb\_get() instead of skb\_clone() for req\_skb (no CVSS, Linux)
- [CVE-2026-93208](https://cve.now/CVE-2026-93208.md): kasan: fix cache shrink race with CPU hotplug (no CVSS, Linux)
- [CVE-2026-93207](https://cve.now/CVE-2026-93207.md): SUNRPC: Zero rpc\_gss\_wire\_cred at svcauth\_gss\_decode\_credbody() entry (CVSS 9.8, Linux)
- [CVE-2026-93206](https://cve.now/CVE-2026-93206.md): PCI/proc: Use file\_ns\_capable() when checking config space read access (no CVSS, Linux)
- [CVE-2026-93205](https://cve.now/CVE-2026-93205.md): iommu/arm-smmu-v3: Manage teardown with devm (no CVSS, Linux)
- [CVE-2026-92680](https://cve.now/CVE-2026-92680.md): Araxis Merge insufficiently protected credentials (CVSS 6.8, Araxis Merge)
- [CVE-2026-97225](https://cve.now/CVE-2026-97225.md): DbGate JSON Runner runners.js code injection (CVSS 5.3, DbGate)
- [CVE-2026-56737](https://cve.now/CVE-2026-56737.md): phpMyFAQ's two-factor authentication login bypasses the password factor (CVSS 8.1, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-73064](https://cve.now/CVE-2026-73064.md): In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into (CVSS 2.9, trustedfirmware Mbed TLS)
- [CVE-2026-58008](https://cve.now/CVE-2026-58008.md): Unchecked HKDF key-size input in EL3 causes a stack buffer overflow (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-58007](https://cve.now/CVE-2026-58007.md): Unchecked SDM mailbox response address enables EL3 secure-memory corruption (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-58006](https://cve.now/CVE-2026-58006.md): Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-58005](https://cve.now/CVE-2026-58005.md): Unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3. (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-58004](https://cve.now/CVE-2026-58004.md): Crafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware. (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-13467](https://cve.now/CVE-2026-13467.md): Systemic Missing Address Validation in SiP SMC Handlers (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-13466](https://cve.now/CVE-2026-13466.md): Unit Confusion in VAB Authentication (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-13465](https://cve.now/CVE-2026-13465.md): EL3 Stack Buffer Overflow in FCS HKDF Request (CVSS 8.3, Altera Trusted Firmware)
- [CVE-2026-97362](https://cve.now/CVE-2026-97362.md): HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread (CVSS 8.7, rejetto hfs2)
- [CVE-2026-90959](https://cve.now/CVE-2026-90959.md): Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file\_url field enables arbitrary file read and pulp container registry signing key theft (CVSS 8.1, Red Hat Ansible Automation Platform 2.6 for RHEL · Red H… +3)
- [CVE-2026-97224](https://cve.now/CVE-2026-97224.md): Excalidraw Imported File restore.ts cross site scripting (CVSS 5.3, Excalidraw)
- [CVE-2026-77707](https://cve.now/CVE-2026-77707.md): TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render Engine (CVSS 5.9, HAVELSAN Liman Render Engine)
- [CVE-2026-65422](https://cve.now/CVE-2026-65422.md): A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to gener (CVSS 6.5, Genetec Security Center)
- [CVE-2026-77703](https://cve.now/CVE-2026-77703.md): SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine (CVSS 5.9, HAVELSAN Liman Render Engine)
- [CVE-2026-97404](https://cve.now/CVE-2026-97404.md): In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. (CVSS 9.2, OpenStack Zaqar)
- [CVE-2026-82094](https://cve.now/CVE-2026-82094.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 7.1, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82093](https://cve.now/CVE-2026-82093.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81552](https://cve.now/CVE-2026-81552.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81549](https://cve.now/CVE-2026-81549.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 9.6, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81548](https://cve.now/CVE-2026-81548.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81547](https://cve.now/CVE-2026-81547.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81545](https://cve.now/CVE-2026-81545.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81539](https://cve.now/CVE-2026-81539.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-77874](https://cve.now/CVE-2026-77874.md): IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities (CVSS 8.6, IBM Enterprise Build of Quarkus)
- [CVE-2026-77825](https://cve.now/CVE-2026-77825.md): IBM ContextForge MCP Gateway is affected by path traversal (CVSS 4.9, IBM ContextForge MCP Gateway)
- [CVE-2026-56736](https://cve.now/CVE-2026-56736.md): phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission (CVSS 8.2, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-6544](https://cve.now/CVE-2026-6544.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.2, IBM Concert)
- [CVE-2026-12559](https://cve.now/CVE-2026-12559.md): Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application (CVSS 7.3, OpenText Vendor Invoice Management for SAP Solutions)
- [CVE-2026-19492](https://cve.now/CVE-2026-19492.md): This Power System update is being released to address (CVSS 3.2, IBM PowerVM Hypervisor)
- [CVE-2026-18870](https://cve.now/CVE-2026-18870.md): This Power System update is being released to address (CVSS 4.3, IBM PowerVM Hypervisor)
- [CVE-2026-90481](https://cve.now/CVE-2026-90481.md): In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate p (CVSS 9.2, PortSwigger Burp Suite DAST)
- [CVE-2026-18857](https://cve.now/CVE-2026-18857.md): This Power System update is being released to address (CVSS 3.4, IBM OPENBMC)
- [CVE-2026-18104](https://cve.now/CVE-2026-18104.md): IBM Db2 Mirror for i is vulnerable to obtain sensitive information \[\] (CVSS 3.3, IBM Db2 Mirror for i)
- [CVE-2026-17511](https://cve.now/CVE-2026-17511.md): This Power System update is being released to address (CVSS 3.4, IBM PowerVM Hypervisor)
- [CVE-2026-17504](https://cve.now/CVE-2026-17504.md): This Power System update is being released to address (CVSS 5.1, IBM PowerVM Hypervisor)
- [CVE-2026-17503](https://cve.now/CVE-2026-17503.md): This Power System update is being released to address (CVSS 5.1, IBM PowerVM Hypervisor)
- [CVE-2026-17413](https://cve.now/CVE-2026-17413.md): This Power System update is being released to address (CVSS 5.1, IBM PowerVM Hypervisor)
- [CVE-2026-97062](https://cve.now/CVE-2026-97062.md): Aureus ERP 1.6.0 Stored XSS via SVG File Upload (CVSS 5.1, Webkul Aureus ERP)
- [CVE-2026-97061](https://cve.now/CVE-2026-97061.md): Black Candy through 3.2.1 Information Disclosure via Playlist Search (CVSS 5.3, blackcandy-org Black Candy)
- [CVE-2026-97059](https://cve.now/CVE-2026-97059.md): DCMTK through 3.7.0 Heap Over-read via NumberOfFrames (CVSS 8.8, OFFIS DCMTK)
- [CVE-2026-97057](https://cve.now/CVE-2026-97057.md): redis-parser through 3.0.0 Denial of Service via Invalid Array Length (CVSS 8.7, NodeRedis redis-parser)
- [CVE-2026-77798](https://cve.now/CVE-2026-77798.md): Velociraptor Authenticated Denial of Service (CVSS 6.5, Rapid7 Velociraptor)
- [CVE-2026-77797](https://cve.now/CVE-2026-77797.md): Velociraptor Prefetch parser out of bounds (CVSS 3.6, Rapid7 Velociraptor)
- [CVE-2026-97360](https://cve.now/CVE-2026-97360.md): HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine (CVSS 10.0, rejetto hfs2)
- [CVE-2026-97359](https://cve.now/CVE-2026-97359.md): HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection (CVSS 10.0, rejetto hfs2)
- [CVE-2026-95521](https://cve.now/CVE-2026-95521.md): Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm (CVSS 7.8, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-95519](https://cve.now/CVE-2026-95519.md): Rpm: code execution via macro expansion of manifest entries in \`rpmgi\` (\`-q -p\` / verify manifest flows) (CVSS 7.8, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-91187](https://cve.now/CVE-2026-91187.md): Improper Verification of Cryptographic Signature in dashbit nimble\_zta Cloudflare strategy (CVSS 9.3, dashbit nimble\_zta · nimble\_zta)
- [CVE-2026-19072](https://cve.now/CVE-2026-19072.md): Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal (CVSS 9.9, Rapid7 Velociraptor)
- [CVE-2026-88916](https://cve.now/CVE-2026-88916.md): Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF (CVSS 6.8, TÜBİTAK ULAKBİM UlakPDF)
- [CVE-2026-88907](https://cve.now/CVE-2026-88907.md): SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF (CVSS 7.4, TÜBİTAK ULAKBİM UlakPDF)
- [CVE-2026-94416](https://cve.now/CVE-2026-94416.md): Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery (CVSS 6.8, Red Hat Ansible Automation Platform 2.6 for RHEL · Red Hat…)
- [CVE-2026-97182](https://cve.now/CVE-2026-97182.md): halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization (CVSS 6.9, halo-dev Halo)
- [CVE-2026-96515](https://cve.now/CVE-2026-96515.md): Command Injection Vulnerability in Netlink ICT HG323RW Router (CVSS 8.6, Netlink ICT Pvt Netlink ICT HG323RW Router)
- [CVE-2026-19532](https://cve.now/CVE-2026-19532.md): Path Traversal in HAVELSAN's Liman MYS (CVSS 5.3, HAVELSAN Liman MYS)
- [CVE-2026-16302](https://cve.now/CVE-2026-16302.md): Spectra Legacy – Gutenberg Blocks \<= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3, brainstormforce Spectra Legacy – Gutenberg Blocks)
- [CVE-2026-4806](https://cve.now/CVE-2026-4806.md): Custom Thank You Page for WooCommerce \<= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset (CVSS 6.5, alexvtn Custom Thank You Page for WooCommerce)
- [CVE-2026-3253](https://cve.now/CVE-2026-3253.md): MailerLite – Signup forms (official) \<= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion (CVSS 4.3, MailerLite – Signup forms)
- [CVE-2026-97311](https://cve.now/CVE-2026-97311.md): Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization (CVSS 4.3, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-7169](https://cve.now/CVE-2026-7169.md): Uncontrolled Search Path Element in Evope Collector (CVSS 7.5, Evope Collector)
- [CVE-2026-4638](https://cve.now/CVE-2026-4638.md): Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor (CVSS 7.1, Paessler PRTG Network Monitor)
- [CVE-2026-79680](https://cve.now/CVE-2026-79680.md): Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module (CVSS 4.5, qt)
- [CVE-2026-97179](https://cve.now/CVE-2026-97179.md): O2OA Cipher Connection CipherConnectionAction.java list information disclosure (CVSS 5.3, O2OA)
- [CVE-2026-4637](https://cve.now/CVE-2026-4637.md): Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor (CVSS 5.1, Paessler PRTG Network Monitor)
- [CVE-2026-12227](https://cve.now/CVE-2026-12227.md): Visual Composer Website Builder \<= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter (CVSS 9.8, visualcomposer Visual Composer Website Builder)
- [CVE-2026-18335](https://cve.now/CVE-2026-18335.md): Kirki – Freeform Page Builder, Website Builder & Customizer \<= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki\_data' Parameter (CVSS 5.4, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-15731](https://cve.now/CVE-2026-15731.md): WP Multilang – Translation and Multilingual Plugin \<= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content (CVSS 6.4, magazine3 WP Multilang – Translation and Multilingual Plugin)
- [CVE-2026-57590](https://cve.now/CVE-2026-57590.md): Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations (CVSS 8.1, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-92905](https://cve.now/CVE-2026-92905.md): Denial of Service Vulnerability (CVSS 5.3, Zohocorp ManageEngine EventLog Analyzer · Zohocorp ManageEn…)
- [CVE-2026-78313](https://cve.now/CVE-2026-78313.md): Improper Access Control in DIAEnergie (CVSS 6.5, Deltaww DIAEnergie)
- [CVE-2026-78312](https://cve.now/CVE-2026-78312.md): Path Traversal in DIAEnergie (CVSS 9.1, Deltaww DIAEnergie)
- [CVE-2026-78310](https://cve.now/CVE-2026-78310.md): Authorization Bypass Through User-Controlled Key in DIAEnergie (CVSS 4.3, Deltaww DIAEnergie)
- [CVE-2026-78311](https://cve.now/CVE-2026-78311.md): SQL Injection in DIAEnergie (CVSS 8.8, Deltaww DIAEnergie)
- [CVE-2026-78309](https://cve.now/CVE-2026-78309.md): SQL Injection in DIAEnergie (CVSS 8.8, Deltaww DIAEnergie)
- [CVE-2026-78308](https://cve.now/CVE-2026-78308.md): Authentication Bypass in DIAEnergie (CVSS 9.8, Deltaww DIAEnergie)
- [CVE-2026-97185](https://cve.now/CVE-2026-97185.md): Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-85682](https://cve.now/CVE-2026-85682.md): YOP Poll \<= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route (CVSS 8.8, yourownprogrammer YOP Poll)
- [CVE-2026-77193](https://cve.now/CVE-2026-77193.md): eesy\_ID2WP – Publish InDesign HTML5 \<= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp\_path' Query Parameter (CVSS 7.5, eesywp eesy\_ID2WP – Publish InDesign HTML5)
- [CVE-2026-97181](https://cve.now/CVE-2026-97181.md): ezGlobal｜GPM LIGHT - Sensitive Data Exposure (CVSS 6.9, ezGlobal GPM LIGHT)
- [CVE-2026-11744](https://cve.now/CVE-2026-11744.md): PaperCut Hive Embedded App for Ricoh: Javascript injection (CVSS 3.8, PaperCut Hive)
- [CVE-2026-87739](https://cve.now/CVE-2026-87739.md): PaperCut MF/NG: User permissions are not evaluated on report generation (CVSS 6.9, PaperCut NG/MF)
- [CVE-2026-82077](https://cve.now/CVE-2026-82077.md): PaperCut NG/MF: Remote Code Execution via Scan2Fax (CVSS 7.3, PaperCut NG/MF)
- [CVE-2026-81645](https://cve.now/CVE-2026-81645.md): Out-of-bounds read vulnerability in the graphics module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2026-93662](https://cve.now/CVE-2026-93662.md): Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter (CVSS 4.3, Events Manager)
- [CVE-2026-93661](https://cve.now/CVE-2026-93661.md): Events Manager \< 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR (CVSS 2.7, Events Manager)
- [CVE-2026-89005](https://cve.now/CVE-2026-89005.md): WPeMatico RSS Feed Fetcher \< 2.8.26 - Contributor+ Stored XSS via Word to Category (CVSS 6.8, WPeMatico RSS Feed Fetcher)
- [CVE-2026-89004](https://cve.now/CVE-2026-89004.md): WPeMatico RSS Feed Fetcher \< 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR (CVSS 2.7, WPeMatico RSS Feed Fetcher)
- [CVE-2026-89002](https://cve.now/CVE-2026-89002.md): WPeMatico RSS Feed Fetcher \< 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview (CVSS 6.8, WPeMatico RSS Feed Fetcher)
- [CVE-2026-88847](https://cve.now/CVE-2026-88847.md): MasterStudy LMS \< 3.7.50 - Subscriber+ Lesson Completion Record Creation (CVSS 4.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-88846](https://cve.now/CVE-2026-88846.md): MasterStudy LMS 2.3.0 - \< 3.7.50 - Unauthenticated Account Creation with Registration Disabled (CVSS 5.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-88845](https://cve.now/CVE-2026-88845.md): MasterStudy LMS 2.3.0 - \< 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import (CVSS 4.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-88843](https://cve.now/CVE-2026-88843.md): MasterStudy LMS 3.5.29 - \< 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget (CVSS 7.2, MasterStudy LMS WordPress Plugin)
- [CVE-2026-84151](https://cve.now/CVE-2026-84151.md): The Post Grid \< 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp\_kses\_post Allow-List Widening (CVSS 3.5, The Post Grid)
- [CVE-2026-82850](https://cve.now/CVE-2026-82850.md): Masteriyo LMS \< 3.4.2 - Subscriber+ Quiz Answer Key Disclosure (CVSS 4.3, Masteriyo LMS)
- [CVE-2026-82849](https://cve.now/CVE-2026-82849.md): Masteriyo LMS \< 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR (CVSS 4.3, Masteriyo LMS)
- [CVE-2026-82195](https://cve.now/CVE-2026-82195.md): 10Web Booster \< 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion (CVSS 6.5, 10Web Booster)
- [CVE-2026-80513](https://cve.now/CVE-2026-80513.md): wpForo Forum \< 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields (CVSS 7.5, wpForo Forum)
- [CVE-2026-80338](https://cve.now/CVE-2026-80338.md): CMB2 \< 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler (CVSS 6.8, CMB2)
- [CVE-2026-74991](https://cve.now/CVE-2026-74991.md): WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent (CVSS 6.8, WPForms)
- [CVE-2026-97177](https://cve.now/CVE-2026-97177.md): Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission (CVSS 6.6, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-97176](https://cve.now/CVE-2026-97176.md): Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator (CVSS 4.2, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-14780](https://cve.now/CVE-2026-14780.md): PaperCut NG/MF: Remote Code Execution via Scripting Subsystem (CVSS 7.5, PaperCut NG/MF)
- [CVE-2026-97155](https://cve.now/CVE-2026-97155.md): Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, do (CVSS 6.5, Fabasoft Folio Client)
- [CVE-2026-96898](https://cve.now/CVE-2026-96898.md): yhx070424 ShopXO Ueditor Upload ueditor.php path traversal (CVSS 6.9, yhx070424 ShopXO)
- [CVE-2026-97152](https://cve.now/CVE-2026-97152.md): Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecke (CVSS 8.6, Nanomsg)
- [CVE-2026-96892](https://cve.now/CVE-2026-96892.md): Edimax BR-6428nC goform websRedirect redirect (CVSS 5.3, Edimax BR-6428nC)
- [CVE-2026-97151](https://cve.now/CVE-2026-97151.md): mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. (CVSS 8.4, mwilliamson mammoth.js)
- [CVE-2026-96891](https://cve.now/CVE-2026-96891.md): D-Link DIR-825 rp-l2tp tunnel.c tunnel\_set\_params out-of-bounds write (CVSS 9.3, D-Link DIR-825)
- [CVE-2026-96884](https://cve.now/CVE-2026-96884.md): MantisZip Preview MainWindow.UI.cs Path.Combine path traversal (CVSS 5.3, MantisZip)
- [CVE-2026-96882](https://cve.now/CVE-2026-96882.md): TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization (CVSS 6.9, TaleLin lin-cms-spring-boot)
- [CVE-2026-97149](https://cve.now/CVE-2026-97149.md): In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. (CVSS 5.3, OpenStack Swift)
- [CVE-2026-96881](https://cve.now/CVE-2026-96881.md): TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization (CVSS 6.9, TaleLin lin-cms-spring-boot)
- [CVE-2026-96880](https://cve.now/CVE-2026-96880.md): TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization (CVSS 6.9, TaleLin lin-cms-spring-boot)
- [CVE-2026-97056](https://cve.now/CVE-2026-97056.md): SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass (CVSS 7.6, signoz)
- [CVE-2026-97055](https://cve.now/CVE-2026-97055.md): SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret (CVSS 9.2, signoz)
- [CVE-2026-96810](https://cve.now/CVE-2026-96810.md): huanzi-qch base-admin Add User CommonController.java save cross site scripting (CVSS 5.1, huanzi-qch base-admin)
- [CVE-2026-96803](https://cve.now/CVE-2026-96803.md): java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection (CVSS 6.9, java110 MicroCommunity)
- [CVE-2026-18467](https://cve.now/CVE-2026-18467.md): Paytium: Mollie payment forms & donations \<= 5.0.3 - Unauthenticated Privilege Escalation via 'pt\_form\_field\[pt-user-role\]' Parameter (CVSS 9.8, paytiumsupport Paytium: Mollie payment forms & donations)
- [CVE-2026-96777](https://cve.now/CVE-2026-96777.md): Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection (CVSS 5.3, Forma LMS)
- [CVE-2026-96774](https://cve.now/CVE-2026-96774.md): SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys\_cfg.txt loadCfg information disclosure (CVSS 6.9, SPON Communications IP Network Audio Device XC-9603)
- [CVE-2026-96773](https://cve.now/CVE-2026-96773.md): Intelliants Subrion CMS Login Page login.php authorize redirect (CVSS 5.3, Intelliants Subrion CMS)
- [CVE-2026-96772](https://cve.now/CVE-2026-96772.md): Intelliants Subrion CMS actions.json assign-owner information disclosure (CVSS 6.9, Intelliants Subrion CMS)
- [CVE-2026-96764](https://cve.now/CVE-2026-96764.md): kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources (CVSS 5.3, kvcache-ai mooncake)
- [CVE-2026-96763](https://cve.now/CVE-2026-96763.md): kvcache-ai mooncake MountSegment Request Processing segment.cpp access control (CVSS 5.3, kvcache-ai mooncake)
- [CVE-2026-51994](https://cve.now/CVE-2026-51994.md): mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource\_metadata URL extracted from (CVSS 9.1)
- [CVE-2026-51995](https://cve.now/CVE-2026-51995.md): An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-s (CVSS 7.5)
- [CVE-2026-51996](https://cve.now/CVE-2026-51996.md): An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getS (CVSS 9.8)
- [CVE-2026-51997](https://cve.now/CVE-2026-51997.md): An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions (CVSS 8.8)
- [CVE-2026-52001](https://cve.now/CVE-2026-52001.md): An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSour (CVSS 7.5)
- [CVE-2026-88351](https://cve.now/CVE-2026-88351.md): An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. (CVSS 9.8)
- [CVE-2026-88355](https://cve.now/CVE-2026-88355.md): An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new\_expr(). (CVSS 7.5)
- [CVE-2026-88357](https://cve.now/CVE-2026-88357.md): nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. (CVSS 7.5)
- [CVE-2026-88358](https://cve.now/CVE-2026-88358.md): simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse\_unpadded(). (CVSS 6.5)
- [CVE-2026-88359](https://cve.now/CVE-2026-88359.md): libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy\_atom\_iter\_format(). (CVSS 6.5)
- [CVE-2026-88360](https://cve.now/CVE-2026-88360.md): libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. (CVSS 7.5)
- [CVE-2026-88361](https://cve.now/CVE-2026-88361.md): SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries. (CVSS 7.5)
- [CVE-2026-88362](https://cve.now/CVE-2026-88362.md): MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR\_isindex() in jsrun.c. (CVSS 7.5)
- [CVE-2026-88365](https://cve.now/CVE-2026-88365.md): minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec\_skip\_id3v1() when parsing the APEv2 tag-size field. (CVSS 9.8)
- [CVE-2026-88366](https://cve.now/CVE-2026-88366.md): NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg\_\_pathArcTo() when parsing SVG arc commands. (CVSS 7.5)
- [CVE-2026-88367](https://cve.now/CVE-2026-88367.md): NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg\_\_curveDivs() during SVG stroke rasterization. (CVSS 6.5)
- [CVE-2026-88368](https://cve.now/CVE-2026-88368.md): NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg\_\_addActive() function. (CVSS 7.5)
- [CVE-2026-88369](https://cve.now/CVE-2026-88369.md): zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump(). (CVSS 7.3)
- [CVE-2026-88370](https://cve.now/CVE-2026-88370.md): libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load\_ini\_buffer.h utility and strip\_ini\_cache(). (CVSS 5.3)
- [CVE-2026-88371](https://cve.now/CVE-2026-88371.md): ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. (CVSS 5.5)
- [CVE-2026-88372](https://cve.now/CVE-2026-88372.md): libsndfile 1.2.2 contains an integer overflow vulnerability in mat4\_read\_header() when parsing crafted MAT4 (MATLAB v4) files. (CVSS 7.5)
- [CVE-2026-88373](https://cve.now/CVE-2026-88373.md): libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. (CVSS 7.5)
- [CVE-2026-88376](https://cve.now/CVE-2026-88376.md): Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4\_AvccAtom::Create() and AP4\_HvccAtom::Create(). (CVSS 7.5)
- [CVE-2026-88377](https://cve.now/CVE-2026-88377.md): Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. (CVSS 6.2)
- [CVE-2026-88378](https://cve.now/CVE-2026-88378.md): QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS\_ReadFunctionTag(). (CVSS 9.8)
- [CVE-2026-88382](https://cve.now/CVE-2026-88382.md): hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. (CVSS 7.5)
- [CVE-2026-88383](https://cve.now/CVE-2026-88383.md): libical 4.0.6 contains an incompatible function pointer in icalparameter\_string\_to\_kind(). (CVSS 6.2)
- [CVE-2026-88384](https://cve.now/CVE-2026-88384.md): OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. (CVSS 5.5)
- [CVE-2026-88385](https://cve.now/CVE-2026-88385.md): Mini-XML 4.0.5 contains a memory leak vulnerability in mxml\_load\_data() during malformed XML parsing. (CVSS 6.5)
- [CVE-2026-88386](https://cve.now/CVE-2026-88386.md): libsndfile 1.2.2 contains a misaligned memory access issue in psf\_binheader\_readf() while parsing WAV fmt chunks. (CVSS 5.5)
- [CVE-2026-88387](https://cve.now/CVE-2026-88387.md): LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse\_tiff\_ifd() when processing TIFF tag 0x00fe (NewSubfile (CVSS 5.5)
- [CVE-2026-88388](https://cve.now/CVE-2026-88388.md): Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64- (CVSS 7.5)
- [CVE-2026-88390](https://cve.now/CVE-2026-88390.md): An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input contain (CVSS 7.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.