# CVEs published 2026-09-25

681 CVEs were published on September 25, 2026: 23 critical, 172 high. Days are UTC.

- [CVE-2026-86066](https://cve.now/CVE-2026-86066.md): Horilla attendance approval endpoint is vulnerable to cross-site request forgery (CVSS 5.9, horilla-hr)
- [CVE-2026-96795](https://cve.now/CVE-2026-96795.md): Horilla: Authenticated RCE in Horilla List-View Export (CVSS 8.8, horilla-hr)
- [CVE-2026-57449](https://cve.now/CVE-2026-57449.md): Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token (CVSS 7.1, actualbudget actual · @actual-app/sync-server)
- [CVE-2026-100502](https://cve.now/CVE-2026-100502.md): Flame through 2.4.0 Admin Token Insufficient Session Expiration (CVSS 5.9, pawelmalak flame)
- [CVE-2026-100501](https://cve.now/CVE-2026-100501.md): Flame through 2.4.0 Brute-Force Attack via Login Endpoint (CVSS 8.3, pawelmalak flame)
- [CVE-2026-100419](https://cve.now/CVE-2026-100419.md): gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink (CVSS 7.3, GitoxideLabs gitoxide)
- [CVE-2026-100418](https://cve.now/CVE-2026-100418.md): Flame through 2.4.0 Information Exposure via GET /api/config (CVSS 6.9, pawelmalak flame)
- [CVE-2026-71483](https://cve.now/CVE-2026-71483.md): Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View (CVSS 8.5, horilla-hr)
- [CVE-2026-63432](https://cve.now/CVE-2026-63432.md): Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata (CVSS 6.5, horilla-hr)
- [CVE-2026-63431](https://cve.now/CVE-2026-63431.md): Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR) (CVSS 6.5, horilla-hr)
- [CVE-2026-88003](https://cve.now/CVE-2026-88003.md): InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade (CVSS 7.5, InvoicePlane)
- [CVE-2026-92842](https://cve.now/CVE-2026-92842.md): OOB read / info leak in convert.\* stream filters when line-break-chars contains NUL (CVSS 5.9, PHP Group PHP)
- [CVE-2026-91768](https://cve.now/CVE-2026-91768.md): IPv6 ACL bypass in FastCGI listen.allowed\_clients due to partial address comparison (memcmp 12 bytes) (CVSS 6.5, PHP Group PHP)
- [CVE-2026-100383](https://cve.now/CVE-2026-100383.md): Stored i18n XSS in WikiLambda's VisualEditor integration (CVSS 4.8, Wikimedia Foundation Mediawiki - WikiLambda Extension)
- [CVE-2026-100382](https://cve.now/CVE-2026-100382.md): Unauthenticated remote code execution through wikitext in ExternalData (CVSS 10.0, Wikimedia Foundation Mediawiki - ExternalData Extension)
- [CVE-2026-100381](https://cve.now/CVE-2026-100381.md): UploadWizard Flickr collection and set titles allow DOM XSS (CVSS 5.3, Wikimedia Foundation Mediawiki - UploadWizard Extension)
- [CVE-2026-91769](https://cve.now/CVE-2026-91769.md): TLS Hostname Verification Falls Back to CN After SAN Mismatch (CVSS 4.3, PHP Group PHP)
- [CVE-2026-100380](https://cve.now/CVE-2026-100380.md): Reflected XSS in Wikibase Special:SetLabel language validation (CVSS 5.3, Wikimedia Foundation Mediawiki - Wikibase Extension)
- [CVE-2026-100379](https://cve.now/CVE-2026-100379.md): Cross-request disclosure of CentralAuth cookies in Wikipedia Android App (CVSS 5.3, Wikimedia Foundation Wikipedia Android App)
- [CVE-2026-91767](https://cve.now/CVE-2026-91767.md): Heap-buffer-overflow in php\_openssl\_matches\_wildcard\_name on crafted server cert wildcard CN (CVSS 6.5, PHP Group PHP)
- [CVE-2026-100378](https://cve.now/CVE-2026-100378.md): Missing permission check in the Translate sandbox doRemind action (CVSS 5.3, Wikimedia Foundation Mediawiki - Translate Extension)
- [CVE-2026-10758](https://cve.now/CVE-2026-10758.md): Esri Lerc has a security vulnerability (CVSS 7.5, Esri Lerc)
- [CVE-2026-100376](https://cve.now/CVE-2026-100376.md): TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix (CVSS 4.8, Wikimedia Foundation Mediawiki - TemplateSandbox Extension)
- [CVE-2025-1218](https://cve.now/CVE-2025-1218.md): Various packet overreads in mysqlnd\_writeprotocol.c (CVSS 3.4, PHP Group PHP)
- [CVE-2026-100377](https://cve.now/CVE-2026-100377.md): Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract (CVSS 6.9, Wikimedia Foundation Mediawiki - WikiLambda Extension)
- [CVE-2026-91766](https://cve.now/CVE-2026-91766.md): Cross-origin credential leak in HTTP stream wrapper redirects (CVSS 5.9, PHP Group PHP)
- [CVE-2026-57443](https://cve.now/CVE-2026-57443.md): SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests (CVSS 7.5, issdandavis SCBE-AETHERMOORE · scbe-aethermoore)
- [CVE-2026-91765](https://cve.now/CVE-2026-91765.md): SOAP: Unbounded Recursion in Server-Side cleanup\_xml\_node (CVSS 7.5, PHP Group PHP)
- [CVE-2026-100369](https://cve.now/CVE-2026-100369.md): CliInvoke: Argument Injection in Extensibility Runner Factory (CVSS 8.4, alastairlundy CliInvoke · AlastairLundy.CliInvoke +1)
- [CVE-2025-14181](https://cve.now/CVE-2025-14181.md): Integer overflow to buffer overflow in soap HTTP parsing (CVSS 6.5, PHP Group PHP)
- [CVE-2026-100417](https://cve.now/CVE-2026-100417.md): RustDesk before 1.5.0 One-Way File Transfer Bypass (CVSS 2.3, rustdesk)
- [CVE-2026-17545](https://cve.now/CVE-2026-17545.md): PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS (CVSS 6.9, PHP Group PHP)
- [CVE-2026-100391](https://cve.now/CVE-2026-100391.md): MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation (CVSS 8.8, mhdzumair mediaflow-proxy)
- [CVE-2026-100390](https://cve.now/CVE-2026-100390.md): Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6 (CVSS 9.1, tobychui zoraxy)
- [CVE-2026-100389](https://cve.now/CVE-2026-100389.md): GestSup before 3.2.62 Remote Code Execution via IMAP Attachment (CVSS 9.2, GestSup)
- [CVE-2026-100388](https://cve.now/CVE-2026-100388.md): RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages (CVSS 5.3, rustdesk)
- [CVE-2026-100387](https://cve.now/CVE-2026-100387.md): pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization (CVSS 7.2, pgpointcloud pointcloud)
- [CVE-2026-96879](https://cve.now/CVE-2026-96879.md): "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" (CVSS 6.9, The Wikimedia Foundation Mediawiki - FlaggedRevs extension)
- [CVE-2026-6103](https://cve.now/CVE-2026-6103.md): Phar TAR phar\_tar\_number() Integer Overflow - Archive Entry Injection (CVSS 4.3, PHP Group PHP · libphp +2)
- [CVE-2026-93682](https://cve.now/CVE-2026-93682.md): Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header (CVSS 5.8, PHP Group PHP)
- [CVE-2026-100368](https://cve.now/CVE-2026-100368.md): CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers (CVSS 8.4, alastairlundy CliInvoke.Specializations · CliInvoke.Spec… +1)
- [CVE-2026-96878](https://cve.now/CVE-2026-96878.md): Cargo Exhibit field alias allows stored XSS (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo extension)
- [CVE-2026-96877](https://cve.now/CVE-2026-96877.md): Reflected XSS through Cargo Drilldown full-text search (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo extension)
- [CVE-2026-100208](https://cve.now/CVE-2026-100208.md): Microsoft Office Outlook Remote Code Execution Vulnerability (CVSS 7.5, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2026-100373](https://cve.now/CVE-2026-100373.md): OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass (CVSS 5.1, open-metadata OpenMetadata)
- [CVE-2026-100372](https://cve.now/CVE-2026-100372.md): ClipBucket v5 before 5.5.3-#197 Path Traversal via template\_editor.php (CVSS 8.6, MacWarrior clipbucket-v5)
- [CVE-2026-100310](https://cve.now/CVE-2026-100310.md): GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR\_PREFIX (CVSS 7.3, GNU libextractor)
- [CVE-2026-96876](https://cve.now/CVE-2026-96876.md): Anonymous reflected XSS in CargoExport invalid-alias errors (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo extension)
- [CVE-2026-96875](https://cve.now/CVE-2026-96875.md): Reflected XSS in Cargo Drilldown hierarchy filters (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo extension)
- [CVE-2026-5267](https://cve.now/CVE-2026-5267.md): Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS (CVSS 7.5, Ciena Navigator NCS)
- [CVE-2026-100306](https://cve.now/CVE-2026-100306.md): TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement (CVSS 6.9, TDuckCloud tduck-survey-form)
- [CVE-2026-100305](https://cve.now/CVE-2026-100305.md): TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint (CVSS 5.3, TDuckCloud tduck-survey-form)
- [CVE-2026-100304](https://cve.now/CVE-2026-100304.md): TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check (CVSS 6.0, TDuckCloud tduck-survey-form)
- [CVE-2026-100303](https://cve.now/CVE-2026-100303.md): TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints (CVSS 5.3, TDuckCloud tduck-survey-form)
- [CVE-2026-97897](https://cve.now/CVE-2026-97897.md): Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting (CVSS 5.1, Krayin laravel-crm)
- [CVE-2026-53629](https://cve.now/CVE-2026-53629.md): GLPI: SQL injection in history tab (CVSS 7.1, glpi-project glpi)
- [CVE-2026-53626](https://cve.now/CVE-2026-53626.md): GLPI: Arbitrary Document Read via Form Context Authorization Bypass (CVSS 7.1, glpi-project glpi)
- [CVE-2026-48482](https://cve.now/CVE-2026-48482.md): GLPI: RCE via Form import (CVSS 9.4, glpi-project glpi)
- [CVE-2026-53625](https://cve.now/CVE-2026-53625.md): GLPI: Privilege Escalation via authtype API manipulation (CVSS 7.5, glpi-project glpi)
- [CVE-2026-53610](https://cve.now/CVE-2026-53610.md): GLPI: Reflected XSS in dashboards (CVSS 7.5, glpi-project glpi)
- [CVE-2026-47679](https://cve.now/CVE-2026-47679.md): GLPI: arbitrary file deletion (CVSS 8.5, glpi-project glpi)
- [CVE-2026-55214](https://cve.now/CVE-2026-55214.md): GLPI: Stored XSS in suppliers (CVSS 8.5, glpi-project glpi)
- [CVE-2026-49470](https://cve.now/CVE-2026-49470.md): GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force (CVSS 7.7, glpi-project glpi)
- [CVE-2026-97896](https://cve.now/CVE-2026-97896.md): krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting (CVSS 5.1, krayin laravel-crm)
- [CVE-2026-55217](https://cve.now/CVE-2026-55217.md): GLPI: Unallowed modfication of knowbase items comments and translations (CVSS 5.3, glpi-project glpi)
- [CVE-2026-53628](https://cve.now/CVE-2026-53628.md): GLPI: Unallowed authentication method update by administrator (CVSS 5.9, glpi-project glpi)
- [CVE-2026-45801](https://cve.now/CVE-2026-45801.md): GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) (CVSS 5.3, glpi-project glpi)
- [CVE-2026-53627](https://cve.now/CVE-2026-53627.md): GLPI: Unexpected access to update operations through the API (CVSS 6.0, glpi-project glpi)
- [CVE-2026-49469](https://cve.now/CVE-2026-49469.md): GLPI: LDAP filter injection in user import feature (CVSS 4.6, glpi-project glpi)
- [CVE-2026-63208](https://cve.now/CVE-2026-63208.md): Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens (CVSS 5.1, zammad)
- [CVE-2026-63006](https://cve.now/CVE-2026-63006.md): Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset (CVSS 5.3, zammad)
- [CVE-2026-63204](https://cve.now/CVE-2026-63204.md): Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets (CVSS 2.3, zammad)
- [CVE-2026-61855](https://cve.now/CVE-2026-61855.md): Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail (CVSS 5.3, zammad)
- [CVE-2026-84461](https://cve.now/CVE-2026-84461.md): Zammad: Missing rate limiting allows password brute-forcing during two-factor login (CVSS 6.9, zammad)
- [CVE-2026-63207](https://cve.now/CVE-2026-63207.md): Zammad: Sensitive Information Exposure in Integration Administration API (CVSS 6.9, zammad)
- [CVE-2026-84465](https://cve.now/CVE-2026-84465.md): Zammad: S/MIME signature verification allows forged sender impersonation (CVSS 7.1, zammad)
- [CVE-2026-84463](https://cve.now/CVE-2026-84463.md): Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute (CVSS 6.3, zammad)
- [CVE-2026-84464](https://cve.now/CVE-2026-84464.md): Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data (CVSS 7.1, zammad)
- [CVE-2026-63216](https://cve.now/CVE-2026-63216.md): Zammad: Stored XSS via unescaped option labels in the object attribute options context UI (CVSS 5.3, zammad)
- [CVE-2026-84458](https://cve.now/CVE-2026-84458.md): Zammad: Account takeover via unverified email matching during SSO auto-link (CVSS 9.1, zammad)
- [CVE-2026-97895](https://cve.now/CVE-2026-97895.md): krayin laravel-crm User Management UserController.php privileges management (CVSS 5.3, krayin laravel-crm)
- [CVE-2026-84460](https://cve.now/CVE-2026-84460.md): Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration (CVSS 5.3, zammad)
- [CVE-2026-63206](https://cve.now/CVE-2026-63206.md): Zammad: Remote image tracking bypass via shortened URL scheme (CVSS 5.3, zammad)
- [CVE-2026-63205](https://cve.now/CVE-2026-63205.md): Zammad: Channel admins can read unauthorized attachments via signature rich-text body (CVSS 5.1, zammad)
- [CVE-2026-97064](https://cve.now/CVE-2026-97064.md): X-SpringBoot through 6.0 Authentication Bypass via Static Master Code (CVSS 9.3, yzcheng90 X-SpringBoot)
- [CVE-2026-97063](https://cve.now/CVE-2026-97063.md): X-SpringBoot through 6.0 Authentication Bypass via Login Code (CVSS 9.3, yzcheng90 X-SpringBoot)
- [CVE-2026-97060](https://cve.now/CVE-2026-97060.md): X-SpringBoot through 6.0 Authorization Bypass via User Management (CVSS 8.6, yzcheng90 X-SpringBoot)
- [CVE-2026-100192](https://cve.now/CVE-2026-100192.md): X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint (CVSS 6.9, yzcheng90 X-SpringBoot)
- [CVE-2026-97886](https://cve.now/CVE-2026-97886.md): mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-91841](https://cve.now/CVE-2026-91841.md): Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection (CVSS 7.8, GNOME NetworkManager-vpnc)
- [CVE-2026-91840](https://cve.now/CVE-2026-91840.md): Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username (CVSS 7.8, GNOME NetworkManager-vpnc)
- [CVE-2026-91839](https://cve.now/CVE-2026-91839.md): Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials (CVSS 7.8, GNOME NetworkManager-fortisslvpn)
- [CVE-2026-91838](https://cve.now/CVE-2026-91838.md): Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields (CVSS 7.8, GNOME NetworkManager-sstp)
- [CVE-2026-97885](https://cve.now/CVE-2026-97885.md): mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-97884](https://cve.now/CVE-2026-97884.md): mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-84462](https://cve.now/CVE-2026-84462.md): Zammad: AI Agent template sanitizer bypass leads to remote code execution (CVSS 8.6, zammad)
- [CVE-2026-65828](https://cve.now/CVE-2026-65828.md): Zammad: Pending upload deletion bypass via legacy attachment endpoint (CVSS 2.3, zammad)
- [CVE-2026-97883](https://cve.now/CVE-2026-97883.md): mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-61525](https://cve.now/CVE-2026-61525.md): Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller (CVSS 8.8, zammad)
- [CVE-2026-56728](https://cve.now/CVE-2026-56728.md): Zammad: Cross-User Taskbar Item Access Control Vulnerability (CVSS 5.3, zammad)
- [CVE-2026-56725](https://cve.now/CVE-2026-56725.md): Zammad: Denial of Service via OTRS Import Controller (CVSS 8.7, zammad)
- [CVE-2026-56732](https://cve.now/CVE-2026-56732.md): Zammad: Malicious input in Ticket Body Enables Session Termination (CVSS 5.3, zammad)
- [CVE-2026-56730](https://cve.now/CVE-2026-56730.md): Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers (CVSS 2.1, zammad)
- [CVE-2026-56733](https://cve.now/CVE-2026-56733.md): Zammad: Incorrect Authorization and Improper Privilege Management (CVSS 8.7, zammad)
- [CVE-2026-56731](https://cve.now/CVE-2026-56731.md): Zammad: Cross-Site Scripting in Ticket Notifications (CVSS 8.4, zammad)
- [CVE-2026-56735](https://cve.now/CVE-2026-56735.md): Zammad: Improper neutralization of \`srcset\` attribute in IMG tags in Zammad (CVSS 5.3, zammad)
- [CVE-2026-56727](https://cve.now/CVE-2026-56727.md): Zammad: PGP signature spoofing via unvalidated verification return (CVSS 7.1, zammad)
- [CVE-2026-56734](https://cve.now/CVE-2026-56734.md): Zammad: Avatar Image URL Server-Side Request Forwarding (CVSS 5.3, zammad)
- [CVE-2026-56726](https://cve.now/CVE-2026-56726.md): Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak (CVSS 5.1, zammad)
- [CVE-2026-93366](https://cve.now/CVE-2026-93366.md): Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints (CVSS 5.3, Bludit CMS)
- [CVE-2026-97882](https://cve.now/CVE-2026-97882.md): mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-93365](https://cve.now/CVE-2026-93365.md): Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint (CVSS 7.1, Bludit CMS)
- [CVE-2026-56729](https://cve.now/CVE-2026-56729.md): Zammad: Titles of knowledge base answers will be shown across all categories via the global search (CVSS 2.1, zammad)
- [CVE-2026-93364](https://cve.now/CVE-2026-93364.md): Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit() (CVSS 5.3, Bludit CMS)
- [CVE-2026-93363](https://cve.now/CVE-2026-93363.md): Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route (CVSS 5.3, payloadcms payload)
- [CVE-2026-56723](https://cve.now/CVE-2026-56723.md): Zammad: Missing authorization on ticket attachment download (CVSS 7.1, zammad)
- [CVE-2026-100237](https://cve.now/CVE-2026-100237.md): Stored i18n XSS in the Flow integration of Thanks (CVSS 6.1, The Wikimedia Foundation Mediawiki - Thanks Extension)
- [CVE-2026-56724](https://cve.now/CVE-2026-56724.md): Zammad: Incorrect implementation of permission checks in the knowledge base module (CVSS 7.1, zammad)
- [CVE-2026-97879](https://cve.now/CVE-2026-97879.md): zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication (CVSS 6.9, zhistaredu StarTraining)
- [CVE-2026-94445](https://cve.now/CVE-2026-94445.md): Malicious user input may lead to RCE in golang.org/x/playground (CVSS 8.8, golang.org/x/playground)
- [CVE-2026-67420](https://cve.now/CVE-2026-67420.md): RabbitMQ OAuth credential refresh retains revoked runtime tags (CVSS 2.3, rabbitmq-server · rabbitmq)
- [CVE-2026-67419](https://cve.now/CVE-2026-67419.md): RabbitMQ: Consecutive topic wildcards cause combinatorial routing work (CVSS 7.1, rabbitmq-server · rabbitmq)
- [CVE-2026-67421](https://cve.now/CVE-2026-67421.md): RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling (CVSS 4.5, rabbitmq-server · rabbitmq)
- [CVE-2026-67408](https://cve.now/CVE-2026-67408.md): RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service (CVSS 7.1, rabbitmq-server · rabbitmq)
- [CVE-2026-67406](https://cve.now/CVE-2026-67406.md): RabbitMQ: Federation and Shovel Gen-Servers Lack format\_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get\_status (CVSS 4.6, rabbitmq-server · rabbitmq)
- [CVE-2026-95835](https://cve.now/CVE-2026-95835.md): Missing ownership check on the shared memory object named by the kitty askpass escape code (CVSS 5.6, Kovid Goyal kitty)
- [CVE-2026-67410](https://cve.now/CVE-2026-67410.md): RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CVSS 8.2, rabbitmq-server · rabbitmq)
- [CVE-2026-67227](https://cve.now/CVE-2026-67227.md): RabbitMQ: Atom exhaustion: to\_atom on global-parameter :name (CVSS 5.9, rabbitmq-server · rabbitmq)
- [CVE-2026-67407](https://cve.now/CVE-2026-67407.md): RabbitMQ: Incomplete fix for CVE-2026-44838: \`escape\_regex\_char/1\` does not escape \`-\`, leaving room for an MQTT topic permission bypass (CVSS 5.1, rabbitmq-server · rabbitmq)
- [CVE-2026-97878](https://cve.now/CVE-2026-97878.md): zhistaredu StarTraining Druid Console index.html anonymous missing authentication (CVSS 6.9, zhistaredu StarTraining)
- [CVE-2026-67226](https://cve.now/CVE-2026-67226.md): RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list (CVSS 6.9, rabbitmq-server · rabbitmq)
- [CVE-2026-95834](https://cve.now/CVE-2026-95834.md): Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer (CVSS 4.6, Kovid Goyal kitty)
- [CVE-2026-18311](https://cve.now/CVE-2026-18311.md): CVE-2026-18311 (CVSS 6.1, Readwise Reader)
- [CVE-2026-18320](https://cve.now/CVE-2026-18320.md): CVE-2026-18320 (CVSS 6.1, Readwise Reader)
- [CVE-2026-18312](https://cve.now/CVE-2026-18312.md): CVE-2026-18312 (CVSS 6.1, Readwise Reader)
- [CVE-2026-67411](https://cve.now/CVE-2026-67411.md): RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-67413](https://cve.now/CVE-2026-67413.md): RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-61837](https://cve.now/CVE-2026-61837.md): RabbitMQ: AMQP 1.0 management \`GET /bindings\` exposes full binding topology to any authenticated AMQP user without resource/management permission checks (CVSS 6.3, rabbitmq-server · rabbitmq)
- [CVE-2026-80432](https://cve.now/CVE-2026-80432.md): Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop (CVSS 6.0, Kovid Goyal kitty)
- [CVE-2026-67415](https://cve.now/CVE-2026-67415.md): RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service (CVSS 5.9, rabbitmq-server · rabbitmq)
- [CVE-2026-67412](https://cve.now/CVE-2026-67412.md): RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-67409](https://cve.now/CVE-2026-67409.md): RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CVSS 8.2, rabbitmq-server · rabbitmq)
- [CVE-2026-67242](https://cve.now/CVE-2026-67242.md): RabbitMQ: OAuth2 is\_integer(Exp) guard skips token-expiry checks for float exp (CVSS 6.3, rabbitmq-server · rabbitmq)
- [CVE-2026-97877](https://cve.now/CVE-2026-97877.md): zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password (CVSS 6.9, zhistaredu StarTraining)
- [CVE-2026-67223](https://cve.now/CVE-2026-67223.md): RabbitMQ: LDAP DN injection via unescaped substitution (CVSS 6.3, rabbitmq-server · rabbitmq)
- [CVE-2026-91837](https://cve.now/CVE-2026-91837.md): Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection (CVSS 7.8, GNOME NetworkManager-iodine)
- [CVE-2026-67239](https://cve.now/CVE-2026-67239.md): RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI (CVSS 7.6, rabbitmq-server · rabbitmq)
- [CVE-2026-67241](https://cve.now/CVE-2026-67241.md): RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check (CVSS 4.8, rabbitmq-server · rabbitmq)
- [CVE-2026-100248](https://cve.now/CVE-2026-100248.md): The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current\_admin. (CVSS 8.4, Rattadan Cosmowarp Contract)
- [CVE-2026-66071](https://cve.now/CVE-2026-66071.md): RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-66078](https://cve.now/CVE-2026-66078.md): RabbitMQ: protected tag bypass via bulk-delete (CVSS 2.1, rabbitmq-server · rabbitmq)
- [CVE-2026-66073](https://cve.now/CVE-2026-66073.md): RabbitMQ: Atom table exhaustion via management API node field (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-67237](https://cve.now/CVE-2026-67237.md): RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint (CVSS 7.5, rabbitmq-server · rabbitmq)
- [CVE-2026-89032](https://cve.now/CVE-2026-89032.md): BerriAI LiteLLM \< 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer (CVSS 8.7, BerriAI litellm)
- [CVE-2026-67234](https://cve.now/CVE-2026-67234.md): RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference (CVSS 2.3, rabbitmq-server · rabbitmq)
- [CVE-2026-67225](https://cve.now/CVE-2026-67225.md): RabbitMQ: Stream-protocol frame length never validated against frame\_max (CVSS 6.3, rabbitmq-server · rabbitmq)
- [CVE-2026-67230](https://cve.now/CVE-2026-67230.md): RabbitMQ: Web-STOMP unbounded pre-auth accumulation (CVSS 6.3, rabbitmq-server · rabbitmq)
- [CVE-2026-67222](https://cve.now/CVE-2026-67222.md): RabbitMQ: list\_to\_atom on auth\_mechanism URI tokens in amqp\_client (CVSS 5.9, rabbitmq-server · rabbitmq)
- [CVE-2026-97871](https://cve.now/CVE-2026-97871.md): Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection (CVSS 6.9, Zhonglun CloudPos)
- [CVE-2026-67236](https://cve.now/CVE-2026-67236.md): RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login (CVSS 8.2, rabbitmq-server · rabbitmq)
- [CVE-2026-92161](https://cve.now/CVE-2026-92161.md): FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider (CVSS 9.8, FriendsOfFlarum oauth · fof/oauth)
- [CVE-2026-42322](https://cve.now/CVE-2026-42322.md): Piwigo: Authenticated RCE via File Upload in Logo Upload Feature (CVSS 9.1, Piwigo)
- [CVE-2026-42324](https://cve.now/CVE-2026-42324.md): Piwigo: Second-Order SQL Injection (CVSS 7.2, Piwigo)
- [CVE-2026-44642](https://cve.now/CVE-2026-44642.md): Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+) (CVSS 8.1, Piwigo)
- [CVE-2026-62262](https://cve.now/CVE-2026-62262.md): Piwigo: Unauthenticated SQL injection in \`pwg.images.filteredSearch.create\` (CVSS 9.1, Piwigo)
- [CVE-2026-42323](https://cve.now/CVE-2026-42323.md): Piwigo: SQL Injection in Batch Manager (CVSS 7.2, Piwigo)
- [CVE-2026-97469](https://cve.now/CVE-2026-97469.md): PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-49850](https://cve.now/CVE-2026-49850.md): InvoicePlane: Missing CSRF Protection on State-Changing delete Actions (CVSS 7.5, InvoicePlane)
- [CVE-2026-50547](https://cve.now/CVE-2026-50547.md): InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier (CVSS 7.5, InvoicePlane)
- [CVE-2026-33639](https://cve.now/CVE-2026-33639.md): InvoicePlane permits DDL injection through tax\_rate\_decimal\_places (CVSS 7.2, InvoicePlane)
- [CVE-2026-100230](https://cve.now/CVE-2026-100230.md): Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / vers (CVSS 5.3, input-leap Input Leap)
- [CVE-2026-39353](https://cve.now/CVE-2026-39353.md): InvoicePlane: Remote Code Execution via Writable Templates Directory (CVSS 9.1, InvoicePlane)
- [CVE-2026-85293](https://cve.now/CVE-2026-85293.md): InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms (CVSS 4.8, InvoicePlane)
- [CVE-2026-85291](https://cve.now/CVE-2026-85291.md): InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check (CVSS 6.5, InvoicePlane)
- [CVE-2026-85289](https://cve.now/CVE-2026-85289.md): InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints (CVSS 6.5, InvoicePlane)
- [CVE-2026-85292](https://cve.now/CVE-2026-85292.md): InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth) (CVSS 4.8, InvoicePlane)
- [CVE-2026-85274](https://cve.now/CVE-2026-85274.md): InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection (CVSS 6.5, InvoicePlane)
- [CVE-2026-85290](https://cve.now/CVE-2026-85290.md): InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging (CVSS 5.3, InvoicePlane)
- [CVE-2026-39372](https://cve.now/CVE-2026-39372.md): InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments (CVSS 4.9, InvoicePlane)
- [CVE-2026-54790](https://cve.now/CVE-2026-54790.md): InvoicePlane: Second-order SQL injection through the unvalidated custom\_field\_table field in the Custom Fields module (CVSS 6.0, InvoicePlane)
- [CVE-2026-97869](https://cve.now/CVE-2026-97869.md): langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization (CVSS 2.1, langchain4j)
- [CVE-2026-97868](https://cve.now/CVE-2026-97868.md): sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting (CVSS 5.1, sheshbabu zen)
- [CVE-2026-96874](https://cve.now/CVE-2026-96874.md): Stored XSS in Cargo Drilldown tab names (CVSS 2.3, The Wikimedia Foundation Mediawiki - Cargo extension)
- [CVE-2026-96812](https://cve.now/CVE-2026-96812.md): Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE (CVSS 8.8, Google gVisor)
- [CVE-2026-97866](https://cve.now/CVE-2026-97866.md): Zhonglun CloudPOS Automatic Update Program.cs channel accessible (CVSS 6.3, Zhonglun CloudPOS)
- [CVE-2026-93030](https://cve.now/CVE-2026-93030.md): FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw. (CVSS 6.5, IBM Financial Transaction Manager (FTM) for Redhat OpenShift)
- [CVE-2026-93306](https://cve.now/CVE-2026-93306.md): This Power System update is being released to address (CVSS 7.1, IBM Server Firmware)
- [CVE-2026-84862](https://cve.now/CVE-2026-84862.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.2, IBM Guardium Data Protection)
- [CVE-2026-84882](https://cve.now/CVE-2026-84882.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.5, IBM Guardium Data Protection)
- [CVE-2026-84884](https://cve.now/CVE-2026-84884.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.5, IBM Guardium Data Protection)
- [CVE-2026-84893](https://cve.now/CVE-2026-84893.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.6, IBM Guardium Data Protection)
- [CVE-2026-93647](https://cve.now/CVE-2026-93647.md): Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address (CVSS 9.3, Zimbra Collaboration Suite)
- [CVE-2026-93643](https://cve.now/CVE-2026-93643.md): Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request (CVSS 9.8, Zimbra Collaboration Suite)
- [CVE-2026-85029](https://cve.now/CVE-2026-85029.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.5, IBM Guardium Data Protection)
- [CVE-2026-93642](https://cve.now/CVE-2026-93642.md): Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation (CVSS 9.3, Zimbra Collaboration Suite)
- [CVE-2026-93641](https://cve.now/CVE-2026-93641.md): Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation (CVSS 9.3, Zimbra Collaboration Suite)
- [CVE-2026-85542](https://cve.now/CVE-2026-85542.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.8, IBM Guardium Data Protection)
- [CVE-2026-100190](https://cve.now/CVE-2026-100190.md): Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page (CVSS 6.3, ail project ail framework)
- [CVE-2026-97222](https://cve.now/CVE-2026-97222.md): Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook (CVSS 5.5, GNOME Gnumeric)
- [CVE-2026-85750](https://cve.now/CVE-2026-85750.md): Piwigo arbitrary file read and remote code execution via insecure image processing (CVSS 7.2, Piwigo)
- [CVE-2026-100187](https://cve.now/CVE-2026-100187.md): AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation (CVSS 6.9, ail project ail framework)
- [CVE-2026-93834](https://cve.now/CVE-2026-93834.md): Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape (CVSS 8.8, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1)
- [CVE-2026-100177](https://cve.now/CVE-2026-100177.md): Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment (CVSS 6.3, ail project ail framework)
- [CVE-2026-97865](https://cve.now/CVE-2026-97865.md): Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization (CVSS 6.9, Open-Web-Analytics)
- [CVE-2026-100176](https://cve.now/CVE-2026-100176.md): Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip (CVSS 8.5, ail project ail framework)
- [CVE-2026-80431](https://cve.now/CVE-2026-80431.md): Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process (CVSS 6.8, Kovid Goyal kitty)
- [CVE-2026-100174](https://cve.now/CVE-2026-100174.md): Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names (CVSS 5.1, ail project ail framework)
- [CVE-2026-100172](https://cve.now/CVE-2026-100172.md): Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes (CVSS 8.5, ail project ail framework)
- [CVE-2026-80430](https://cve.now/CVE-2026-80430.md): Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory (CVSS 4.6, Kovid Goyal kitty)
- [CVE-2026-98162](https://cve.now/CVE-2026-98162.md): smb/server: fix tree connection leak in smb2\_tree\_connect() (no CVSS, Linux)
- [CVE-2026-98161](https://cve.now/CVE-2026-98161.md): nvdimm: pmem: keep PREFLUSH before data writes (no CVSS, Linux)
- [CVE-2026-98160](https://cve.now/CVE-2026-98160.md): staging: rtl8723bs: fix mismatched free of HalData in rtw\_sdio\_if1\_init() (no CVSS, Linux)
- [CVE-2026-100079](https://cve.now/CVE-2026-100079.md): usb: typec: ucsi: unregister debugfs entries on teardown (no CVSS, Linux)
- [CVE-2026-100078](https://cve.now/CVE-2026-100078.md): wifi: iwlwifi: mei: pass correct argument to function (no CVSS, Linux)
- [CVE-2026-100077](https://cve.now/CVE-2026-100077.md): drm/msm: Recover HW before retire hung submit (no CVSS, Linux)
- [CVE-2026-100076](https://cve.now/CVE-2026-100076.md): staging: rtl8723bs: fix xmit\_frame/xmit\_buf leaks on mgnt-frame error paths (no CVSS, Linux)
- [CVE-2026-100075](https://cve.now/CVE-2026-100075.md): RDMA/srpt: Fix srpt\_alloc\_rw\_ctxs() unwind counters (CVSS 9.8, Linux)
- [CVE-2026-100074](https://cve.now/CVE-2026-100074.md): bpf: Mark bpf\_refcount field as unique (no CVSS, Linux)
- [CVE-2026-100073](https://cve.now/CVE-2026-100073.md): ext4: fix transaction overflow during writeback (no CVSS, Linux)
- [CVE-2026-100072](https://cve.now/CVE-2026-100072.md): ACPI: platform: Use acpi\_bus\_get\_primary\_device() (no CVSS, Linux)
- [CVE-2026-100071](https://cve.now/CVE-2026-100071.md): net: hsr: free learned nodes on device setup failure (no CVSS, Linux)
- [CVE-2026-100070](https://cve.now/CVE-2026-100070.md): netfilter: nf\_nat\_sip: rewind offset when NAT shrinks the packet (no CVSS, Linux)
- [CVE-2026-97864](https://cve.now/CVE-2026-97864.md): GibbonEdu Gibbon Unit Planner units\_add\_blockAjax.php makeBlock missing authentication (CVSS 6.9, GibbonEdu Gibbon)
- [CVE-2026-95832](https://cve.now/CVE-2026-95832.md): Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell (CVSS 9.3, Kovid Goyal kitty)
- [CVE-2026-97875](https://cve.now/CVE-2026-97875.md): DNS rebinding vulnerability in rojo serve HTTP API (CVSS 8.1, rojo-rbx rojo · rojo)
- [CVE-2026-98159](https://cve.now/CVE-2026-98159.md): wifi: mt76: mt7921: validate CLC firmware records (no CVSS, Linux)
- [CVE-2026-98158](https://cve.now/CVE-2026-98158.md): ppp\_async: drop the errored frame instead of resetting its headroom (no CVSS, Linux)
- [CVE-2026-98157](https://cve.now/CVE-2026-98157.md): EDAC/device\_sysfs: Use kstrtouint() for poll\_msec to prevent truncation (no CVSS, Linux)
- [CVE-2026-98156](https://cve.now/CVE-2026-98156.md): drm/virtio: use the DMA API for resource backing on Xen (CVSS 7.8, Linux)
- [CVE-2026-98155](https://cve.now/CVE-2026-98155.md): accel/qaic: Address potential out-of-bounds read in resp\_worker() (no CVSS, Linux)
- [CVE-2026-98154](https://cve.now/CVE-2026-98154.md): nvme-rdma: fix -EIO cleanup order in queue\_rq (CVSS 7.0, Linux)
- [CVE-2026-98153](https://cve.now/CVE-2026-98153.md): nvme: fix racy access to FDP placement id array (no CVSS, Linux)
- [CVE-2026-98152](https://cve.now/CVE-2026-98152.md): nvmet-rdma: fix queue leak when connect backlog is exceeded (no CVSS, Linux)
- [CVE-2026-98151](https://cve.now/CVE-2026-98151.md): bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic (no CVSS, Linux)
- [CVE-2026-98150](https://cve.now/CVE-2026-98150.md): bpf: Fix BPF\_F\_CPU validation for sparse CPU IDs (CVSS 7.0, Linux)
- [CVE-2026-98149](https://cve.now/CVE-2026-98149.md): bpf: Fix percpu map update indexing with sparse CPU IDs (no CVSS, Linux)
- [CVE-2026-98148](https://cve.now/CVE-2026-98148.md): drm/gud: validate GUD\_ROTATION\_0 is present in supported rotations (no CVSS, Linux)
- [CVE-2026-98147](https://cve.now/CVE-2026-98147.md): printk: Don't WARN on kthread\_run failure. (no CVSS, Linux)
- [CVE-2026-98146](https://cve.now/CVE-2026-98146.md): accel/amdxdna: Remove \_\_counted\_by from struct amdxdna\_cmd\_chain (no CVSS, Linux)
- [CVE-2026-98145](https://cve.now/CVE-2026-98145.md): accel/amdxdna: reject a command chain that carries no commands (no CVSS, Linux)
- [CVE-2026-98144](https://cve.now/CVE-2026-98144.md): accel/amdxdna: put the chained BO when its mapping fails (no CVSS, Linux)
- [CVE-2026-98143](https://cve.now/CVE-2026-98143.md): accel: ethosu: Don't read the U65 rounding mode as a storage mode (CVSS 7.8, Linux)
- [CVE-2026-98142](https://cve.now/CVE-2026-98142.md): drm/cirrus-qemu: Validate BAR0 size during probe (no CVSS, Linux)
- [CVE-2026-98141](https://cve.now/CVE-2026-98141.md): ntfs: propagate reparse index insertion failure (no CVSS, Linux)
- [CVE-2026-98140](https://cve.now/CVE-2026-98140.md): ntfs: fix kmap\_local leak in write\_mft\_record\_nolock() error paths (no CVSS, Linux)
- [CVE-2026-98139](https://cve.now/CVE-2026-98139.md): ntfs: only count successfully cleared runs when freeing clusters (no CVSS, Linux)
- [CVE-2026-98138](https://cve.now/CVE-2026-98138.md): ntfs: do not mark the volume clean in sync\_fs when errors were recorded (no CVSS, Linux)
- [CVE-2026-98137](https://cve.now/CVE-2026-98137.md): ntfs: treat any nonzero dio zero-range return as an error (no CVSS, Linux)
- [CVE-2026-98136](https://cve.now/CVE-2026-98136.md): ntfs: bound $AttrDef table walk to the loaded table size (no CVSS, Linux)
- [CVE-2026-98135](https://cve.now/CVE-2026-98135.md): ntfs: reject invalid sectors\_per\_cluster in the boot sector (no CVSS, Linux)
- [CVE-2026-98134](https://cve.now/CVE-2026-98134.md): bpf: check\_cond\_jmp\_op(): properly infer if register is null (no CVSS, Linux)
- [CVE-2026-98133](https://cve.now/CVE-2026-98133.md): ntfs: leave HasEA flag untouched on setxattr failure (no CVSS, Linux)
- [CVE-2026-98132](https://cve.now/CVE-2026-98132.md): bpf: don't downgrade half-dead scalar zero spills to STACK\_ZERO (no CVSS, Linux)
- [CVE-2026-98131](https://cve.now/CVE-2026-98131.md): net: stmmac: fix dma mapping leak in stmmac\_tso\_xmit() (no CVSS, Linux)
- [CVE-2026-98130](https://cve.now/CVE-2026-98130.md): sctp: fix a TOCTOU race in SCTP\_CMD\_TIMER\_START (CVSS 8.1, Linux)
- [CVE-2026-98129](https://cve.now/CVE-2026-98129.md): scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr\_sas\_port\_add() (no CVSS, Linux)
- [CVE-2026-98128](https://cve.now/CVE-2026-98128.md): scsi: mpi3mr: Fix target device refcount leak in mpi3mr\_sas\_port\_add() (no CVSS, Linux)
- [CVE-2026-98127](https://cve.now/CVE-2026-98127.md): smb/client: validate new EOF for insert range (no CVSS, Linux)
- [CVE-2026-98126](https://cve.now/CVE-2026-98126.md): smb/client: validate new EOF for zero range (no CVSS, Linux)
- [CVE-2026-98125](https://cve.now/CVE-2026-98125.md): smb/client: fix stale page cache in insert/collapse range (no CVSS, Linux)
- [CVE-2026-98124](https://cve.now/CVE-2026-98124.md): smb/client: invalidate fscache for fallocate range operations (no CVSS, Linux)
- [CVE-2026-98123](https://cve.now/CVE-2026-98123.md): sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration (no CVSS, Linux)
- [CVE-2026-98122](https://cve.now/CVE-2026-98122.md): vxlan: mdb: Fix use-after-free in vxlan\_mdb\_remote\_src\_del() (CVSS 7.8, Linux)
- [CVE-2026-98121](https://cve.now/CVE-2026-98121.md): watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (no CVSS, Linux)
- [CVE-2026-98120](https://cve.now/CVE-2026-98120.md): netfs: Fix subreq ref leak (no CVSS, Linux)
- [CVE-2026-98119](https://cve.now/CVE-2026-98119.md): netfs: break unbuffered write when netfs\_alloc\_subrequest() fails (no CVSS, Linux)
- [CVE-2026-98118](https://cve.now/CVE-2026-98118.md): netfs: Fix readahead synchronisation issues by loading all folios upfront (no CVSS, Linux)
- [CVE-2026-98117](https://cve.now/CVE-2026-98117.md): cachefiles: Fix potential UAF/KASAN warning (no CVSS, Linux)
- [CVE-2026-98116](https://cve.now/CVE-2026-98116.md): ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVSS 7.8, Linux)
- [CVE-2026-98115](https://cve.now/CVE-2026-98115.md): ksmbd: safely drain sessions during logoff (CVSS 8.8, Linux)
- [CVE-2026-98114](https://cve.now/CVE-2026-98114.md): ksmbd: propagate DACL parsing errors (no CVSS, Linux)
- [CVE-2026-98113](https://cve.now/CVE-2026-98113.md): ksmbd: rate limit unmapped SID errors (no CVSS, Linux)
- [CVE-2026-98112](https://cve.now/CVE-2026-98112.md): ksmbd: fix listener task lifetime on netdev events (CVSS 7.8, Linux)
- [CVE-2026-98111](https://cve.now/CVE-2026-98111.md): Bluetooth: btintel: validate version TLV value lengths (no CVSS, Linux)
- [CVE-2026-98110](https://cve.now/CVE-2026-98110.md): Bluetooth: btintel: bound firmware ID by TLV length (no CVSS, Linux)
- [CVE-2026-98109](https://cve.now/CVE-2026-98109.md): Bluetooth: hci\_core: Fix race condition during device registration (no CVSS, Linux)
- [CVE-2026-98108](https://cve.now/CVE-2026-98108.md): Bluetooth: L2CAP: fix chan mode for LE\_CONN\_REQ + EXT\_FLOWCTL pchan (CVSS 7.5, Linux)
- [CVE-2026-98107](https://cve.now/CVE-2026-98107.md): Bluetooth: L2CAP: fix out-of-bounds write in l2cap\_ecred\_connect (no CVSS, Linux)
- [CVE-2026-98106](https://cve.now/CVE-2026-98106.md): drm/pagemap: Prevent double migration of device pages (no CVSS, Linux)
- [CVE-2026-98105](https://cve.now/CVE-2026-98105.md): net: ethernet: oa\_tc6: Improve the error recovery (no CVSS, Linux)
- [CVE-2026-98104](https://cve.now/CVE-2026-98104.md): net/sched: cls\_u32: fix duplicate handle when node ID pool is exhausted (no CVSS, Linux)
- [CVE-2026-98103](https://cve.now/CVE-2026-98103.md): igmp: convert struct ip\_sf\_list to RCU (no CVSS, Linux)
- [CVE-2026-98102](https://cve.now/CVE-2026-98102.md): ipv6: mcast: fix RCU list diversion in ip6\_mc\_del1\_src() (no CVSS, Linux)
- [CVE-2026-98101](https://cve.now/CVE-2026-98101.md): ipv6: mcast: use copy-on-write RCU updates in ip6\_mc\_source() (no CVSS, Linux)
- [CVE-2026-27867](https://cve.now/CVE-2026-27867.md): CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT (CVSS 4.8, Teldat Regesta Smart HD-PLC - TLDPH16D2)
- [CVE-2026-97228](https://cve.now/CVE-2026-97228.md): Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup (CVSS 2.7, Rapid7 Platform)
- [CVE-2026-98099](https://cve.now/CVE-2026-98099.md): ipv6: mcast: use rcu\_assign\_pointer() for \_\_rcu list updates (no CVSS, Linux)
- [CVE-2026-98098](https://cve.now/CVE-2026-98098.md): tipc: fix NULL deref in tipc\_named\_node\_up() on empty publication list (no CVSS, Linux)
- [CVE-2026-98097](https://cve.now/CVE-2026-98097.md): tipc: Dont send random pad bytes in RESET/ACTIVATE messages (no CVSS, Linux)
- [CVE-2026-98096](https://cve.now/CVE-2026-98096.md): ipv6: sr: restore network header before routing and forwarding (CVSS 7.4, Linux)
- [CVE-2026-98095](https://cve.now/CVE-2026-98095.md): af\_packet: Don't cast tpacket\_hdr.tp\_len to int in tpacket\_parse\_header(). (CVSS 5.5, Linux)
- [CVE-2026-98094](https://cve.now/CVE-2026-98094.md): staging: fbtft: make dirty\_lock IRQ-safe (CVSS 5.5, Linux)
- [CVE-2026-98093](https://cve.now/CVE-2026-98093.md): ASoC: fsl\_micfil: balance mclk enable/disable (CVSS 7.8, Linux)
- [CVE-2026-98092](https://cve.now/CVE-2026-98092.md): ASoC: amd: yc: fix memory leak in acp6x\_pdm\_dma\_close() (no CVSS, Linux)
- [CVE-2026-98091](https://cve.now/CVE-2026-98091.md): btrfs: detach failed sprout device from transaction update list (CVSS 5.5, Linux)
- [CVE-2026-98090](https://cve.now/CVE-2026-98090.md): btrfs: restore active device pointers after failed sprout (CVSS 5.5, Linux)
- [CVE-2026-98089](https://cve.now/CVE-2026-98089.md): bonding: alb: fix uninitialized transport header access in alb\_determine\_nd() (no CVSS, Linux)
- [CVE-2026-98088](https://cve.now/CVE-2026-98088.md): scsi: mpt3sas: Avoid out-of-bounds cpumask\_of\_node() call in \_base\_assign\_reply\_queues() (no CVSS, Linux)
- [CVE-2026-98087](https://cve.now/CVE-2026-98087.md): sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (no CVSS, Linux)
- [CVE-2026-98086](https://cve.now/CVE-2026-98086.md): ALSA: ump: do not touch legacy\_rmidi before it exists (no CVSS, Linux)
- [CVE-2026-98085](https://cve.now/CVE-2026-98085.md): bpf: backtrack\_insn(): Handle ld\_{abs,ind} subprog exit edge (no CVSS, Linux)
- [CVE-2026-98084](https://cve.now/CVE-2026-98084.md): bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks (no CVSS, Linux)
- [CVE-2026-98083](https://cve.now/CVE-2026-98083.md): btrfs: fix transaction use-after-free in raid stripe insertion (CVSS 7.0, Linux)
- [CVE-2026-98082](https://cve.now/CVE-2026-98082.md): btrfs: fix the possible bioc\_list memory leak during error (no CVSS, Linux)
- [CVE-2026-98081](https://cve.now/CVE-2026-98081.md): btrfs: zoned: finish active block group cleanup if call\_zone\_finish() fails (no CVSS, Linux)
- [CVE-2026-98080](https://cve.now/CVE-2026-98080.md): btrfs: do not force reloc root creation during qgroup\_account\_snapshot() (no CVSS, Linux)
- [CVE-2026-98079](https://cve.now/CVE-2026-98079.md): btrfs: zstd: fix lost wakeup when waiting for a workspace (no CVSS, Linux)
- [CVE-2026-98078](https://cve.now/CVE-2026-98078.md): ipvs: fix reversed sequence option serialization (no CVSS, Linux)
- [CVE-2026-98077](https://cve.now/CVE-2026-98077.md): netfilter: nf\_conntrack\_sip: fix OOB read in sip\_skip\_whitespace() (no CVSS, Linux)
- [CVE-2026-98076](https://cve.now/CVE-2026-98076.md): tracing/probes: Fix use-after-free on field name/type of events with multiple probes (no CVSS, Linux)
- [CVE-2026-98075](https://cve.now/CVE-2026-98075.md): bpf: reject BPF\_PSEUDO\_FUNC reference to the main program (no CVSS, Linux)
- [CVE-2026-98074](https://cve.now/CVE-2026-98074.md): bonding: do not clear curr\_active\_slave prematurely when releasing all slaves (no CVSS, Linux)
- [CVE-2026-98073](https://cve.now/CVE-2026-98073.md): net: Remove conflicting altnames for dying netns in \_\_dev\_change\_net\_namespace(). (CVSS 7.8, Linux)
- [CVE-2026-98072](https://cve.now/CVE-2026-98072.md): net/rds: use wq\_has\_sleeper() in release\_in\_xmit() (no CVSS, Linux)
- [CVE-2026-98071](https://cve.now/CVE-2026-98071.md): net/rds: clear cp\_flags bits individually in rds\_conn\_path\_reset() (no CVSS, Linux)
- [CVE-2026-98070](https://cve.now/CVE-2026-98070.md): net/rds: acquire RDS\_IN\_XMIT in rds\_tcp\_reset\_callbacks() (CVSS 8.1, Linux)
- [CVE-2026-98069](https://cve.now/CVE-2026-98069.md): net/rds: acquire the fastpath locks in rds\_conn\_shutdown() (CVSS 8.1, Linux)
- [CVE-2026-98068](https://cve.now/CVE-2026-98068.md): net/rds: don't let rds\_conn\_shutdown() consume a concurrent drop (no CVSS, Linux)
- [CVE-2026-98067](https://cve.now/CVE-2026-98067.md): erofs: disable LZ4 rolling decompression for now (no CVSS, Linux)
- [CVE-2026-98066](https://cve.now/CVE-2026-98066.md): ALSA: caiaq: Fix potential double-free at error path (no CVSS, Linux)
- [CVE-2026-98065](https://cve.now/CVE-2026-98065.md): bpf: Reject key-less BTF for hash maps (no CVSS, Linux)
- [CVE-2026-98064](https://cve.now/CVE-2026-98064.md): bpf: Fix NULL-ptr-deref when showing a void BTF type (no CVSS, Linux)
- [CVE-2026-98063](https://cve.now/CVE-2026-98063.md): bpf: Fix NULL-ptr-deref in btf\_var\_show() (no CVSS, Linux)
- [CVE-2026-98062](https://cve.now/CVE-2026-98062.md): bpf: Mark signal tracepoint siginfo arguments as scalar (no CVSS, Linux)
- [CVE-2026-98061](https://cve.now/CVE-2026-98061.md): bpf: Reject tail calls directly from callback frames (no CVSS, Linux)
- [CVE-2026-98060](https://cve.now/CVE-2026-98060.md): bpf: Reject resilient lock operations in rbtree callbacks (no CVSS, Linux)
- [CVE-2026-98059](https://cve.now/CVE-2026-98059.md): bpf: Mark sched\_process\_wait argument as nullable (no CVSS, Linux)
- [CVE-2026-98058](https://cve.now/CVE-2026-98058.md): bpf: Mark syscall helpers as sleepable (no CVSS, Linux)
- [CVE-2026-98057](https://cve.now/CVE-2026-98057.md): ring-buffer: Add checking nr\_subbufs to persistent ring buffer validation (no CVSS, Linux)
- [CVE-2026-98056](https://cve.now/CVE-2026-98056.md): nvme: remove stale namespaces by NSID range during scan (CVSS 7.5, Linux)
- [CVE-2026-98055](https://cve.now/CVE-2026-98055.md): ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (no CVSS, Linux)
- [CVE-2026-98054](https://cve.now/CVE-2026-98054.md): ASoC: Intel: avs: Fix unbalanced module reference count (no CVSS, Linux)
- [CVE-2026-98053](https://cve.now/CVE-2026-98053.md): ASoC: Intel: avs: Refactor and fix init\_config access (no CVSS, Linux)
- [CVE-2026-98052](https://cve.now/CVE-2026-98052.md): net: bcmasp: clear txcb-\>last before writing each descriptor (CVSS 7.8, Linux)
- [CVE-2026-98051](https://cve.now/CVE-2026-98051.md): net: bcmasp: fix tx\_spb\_ring\_full() checking same slot cnt times (no CVSS, Linux)
- [CVE-2026-98050](https://cve.now/CVE-2026-98050.md): mlxsw: spectrum\_ptp: Fix napi\_gro\_receive() call from GC workqueue context (CVSS 7.5, Linux)
- [CVE-2026-98049](https://cve.now/CVE-2026-98049.md): bpf: zero extend the result of an arena 32-bit cmpxchg (no CVSS, Linux)
- [CVE-2026-98048](https://cve.now/CVE-2026-98048.md): bpf: don't rewrite bpf\_fastcall patterns entered by a jump (no CVSS, Linux)
- [CVE-2026-98047](https://cve.now/CVE-2026-98047.md): bpf: Check ancestor frames for rbtree callbacks (no CVSS, Linux)
- [CVE-2026-98046](https://cve.now/CVE-2026-98046.md): bpf: Mark bpf\_btf\_find\_by\_name\_kind() as sleepable (no CVSS, Linux)
- [CVE-2026-98045](https://cve.now/CVE-2026-98045.md): bpf: Mark faultable stack helpers as sleepable (no CVSS, Linux)
- [CVE-2026-98044](https://cve.now/CVE-2026-98044.md): bpf: Reject legacy packet loads from callbacks (no CVSS, Linux)
- [CVE-2026-98043](https://cve.now/CVE-2026-98043.md): bpf: Don't infer non-NULL from a pointer with an unbounded offset (no CVSS, Linux)
- [CVE-2026-98042](https://cve.now/CVE-2026-98042.md): bpf: Don't resurrect a scalar id dropped by collect\_linked\_regs() (no CVSS, Linux)
- [CVE-2026-98041](https://cve.now/CVE-2026-98041.md): bpf: Don't predict JMP32 pointer vs zero comparisons (CVSS 7.0, Linux)
- [CVE-2026-98040](https://cve.now/CVE-2026-98040.md): bpf: Mark the zero register precise for a register-form NULL check (no CVSS, Linux)
- [CVE-2026-98039](https://cve.now/CVE-2026-98039.md): bpf: Require MEM\_PERCPU for percpu kptr stores (no CVSS, Linux)
- [CVE-2026-98038](https://cve.now/CVE-2026-98038.md): bpf: Keep refcount\_acquire nullable for borrowed RCU kptrs (no CVSS, Linux)
- [CVE-2026-98037](https://cve.now/CVE-2026-98037.md): bpf: Reject untrusted allocated-object pointers (no CVSS, Linux)
- [CVE-2026-98036](https://cve.now/CVE-2026-98036.md): bpf: Preserve special fields in recycled rhtab elements (no CVSS, Linux)
- [CVE-2026-98035](https://cve.now/CVE-2026-98035.md): bpf: Cancel special fields when recycling rhtab elements (no CVSS, Linux)
- [CVE-2026-98034](https://cve.now/CVE-2026-98034.md): bpf: Mark NULL kptr stores precise (no CVSS, Linux)
- [CVE-2026-98033](https://cve.now/CVE-2026-98033.md): bpf: Preserve inner map identity in callback frames (no CVSS, Linux)
- [CVE-2026-98032](https://cve.now/CVE-2026-98032.md): tracing: Fix subbuf resize races with trace\_pipe\_raw readers (no CVSS, Linux)
- [CVE-2026-98031](https://cve.now/CVE-2026-98031.md): nexthop: Initialize extack in remove\_nh\_grp\_entry() (no CVSS, Linux)
- [CVE-2026-98030](https://cve.now/CVE-2026-98030.md): net: dsa: bcm\_sf2: bound the CFP rule dump by the caller's buffer size (CVSS 7.0, Linux)
- [CVE-2026-98029](https://cve.now/CVE-2026-98029.md): eth: nfp: bound the ntuple rule dump by the caller's buffer size (CVSS 7.0, Linux)
- [CVE-2026-98028](https://cve.now/CVE-2026-98028.md): eth: nfp: drop the replaced rule from the list when reprogramming fails (no CVSS, Linux)
- [CVE-2026-98027](https://cve.now/CVE-2026-98027.md): net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size (CVSS 7.0, Linux)
- [CVE-2026-98026](https://cve.now/CVE-2026-98026.md): net: bridge: mcast: properly convert mglist to rcu (no CVSS, Linux)
- [CVE-2026-98025](https://cve.now/CVE-2026-98025.md): net: usb: cx82310\_eth: drop URB after 0xffff reboot sentinel to prevent partial\_data heap overflow (no CVSS, Linux)
- [CVE-2026-98024](https://cve.now/CVE-2026-98024.md): s390/ism: folio\_put() after error (no CVSS, Linux)
- [CVE-2026-98023](https://cve.now/CVE-2026-98023.md): vxlan: reject dynamic fdb entries that reference a nexthop id (CVSS 7.8, Linux)
- [CVE-2026-98022](https://cve.now/CVE-2026-98022.md): net: cap tx\_queue\_len at S16\_MAX to prevent oversized ring allocations (no CVSS, Linux)
- [CVE-2026-98021](https://cve.now/CVE-2026-98021.md): net: reject oversized tx\_queue\_len at netlink parse time (no CVSS, Linux)
- [CVE-2026-98020](https://cve.now/CVE-2026-98020.md): pds\_core: fix cmd\_regs access racing BAR unmap on reset (no CVSS, Linux)
- [CVE-2026-98019](https://cve.now/CVE-2026-98019.md): bpf: mark a NULL call argument precise (no CVSS, Linux)
- [CVE-2026-98018](https://cve.now/CVE-2026-98018.md): net: mctp: i3c: serialize probe with bus removal (no CVSS, Linux)
- [CVE-2026-98017](https://cve.now/CVE-2026-98017.md): net/sched: defer qdisc freeing after failed creation (CVSS 7.8, Linux)
- [CVE-2026-98016](https://cve.now/CVE-2026-98016.md): net/mlx5e: Fix use-after-free race in sample\_restore\_put() (no CVSS, Linux)
- [CVE-2026-98015](https://cve.now/CVE-2026-98015.md): net/mlx5: E-Switch: fix use-after-free in mlx5\_eswitch\_termtbl\_put (no CVSS, Linux)
- [CVE-2026-98014](https://cve.now/CVE-2026-98014.md): net/mlx5: E-Switch, prevent mc\_list repopulation during vport disable (no CVSS, Linux)
- [CVE-2026-98013](https://cve.now/CVE-2026-98013.md): net/sched: fq\_pie: clamp quantum in change path (no CVSS, Linux)
- [CVE-2026-98012](https://cve.now/CVE-2026-98012.md): net/sched: sfq: clamp quantum in change path (no CVSS, Linux)
- [CVE-2026-98011](https://cve.now/CVE-2026-98011.md): net/sched: hhf: clamp quantum in change and init paths (no CVSS, Linux)
- [CVE-2026-98010](https://cve.now/CVE-2026-98010.md): net/sched: drr: clamp quantum in change class (no CVSS, Linux)
- [CVE-2026-98009](https://cve.now/CVE-2026-98009.md): net/sched: ets: clamp quantum in parse and fallback paths (no CVSS, Linux)
- [CVE-2026-98008](https://cve.now/CVE-2026-98008.md): net: macb: fix NULL pointer dereference on unbind with fixed-link (no CVSS, Linux)
- [CVE-2026-98007](https://cve.now/CVE-2026-98007.md): bpf: Reject non-scalar bpf\_loop iteration counts (no CVSS, Linux)
- [CVE-2026-98006](https://cve.now/CVE-2026-98006.md): ALSA: caiaq: Decoupling ep1\_in\_urb in caiaq dev (no CVSS, Linux)
- [CVE-2026-98005](https://cve.now/CVE-2026-98005.md): erofs: delimit inode\_share cache key components (no CVSS, Linux)
- [CVE-2026-98004](https://cve.now/CVE-2026-98004.md): iommu/riscv: Serialize command queue publishing (no CVSS, Linux)
- [CVE-2026-98003](https://cve.now/CVE-2026-98003.md): iommu/amd: Do not reallocate GA log buffers on resume (no CVSS, Linux)
- [CVE-2026-98002](https://cve.now/CVE-2026-98002.md): iommu/amd: Fix ineffective error check in nested domain allocation (CVSS 7.8, Linux)
- [CVE-2026-98001](https://cve.now/CVE-2026-98001.md): hwmon: (ltc4282) Make sure clk\_init\_data is fully initialized (no CVSS, Linux)
- [CVE-2026-98000](https://cve.now/CVE-2026-98000.md): hwmon: Fix potential UAF in pec\_store (no CVSS, Linux)
- [CVE-2026-97998](https://cve.now/CVE-2026-97998.md): netfilter: nfnetlink\_log: cope with concurrent instance destruction (no CVSS, Linux)
- [CVE-2026-97997](https://cve.now/CVE-2026-97997.md): virtio\_ring: fix stale descriptor flags after a failed packed add (no CVSS, Linux)
- [CVE-2026-97996](https://cve.now/CVE-2026-97996.md): virtio: fix use-after-free in unregister\_virtio\_device() (no CVSS, Linux)
- [CVE-2026-97995](https://cve.now/CVE-2026-97995.md): virtio\_console: do not free control-out buffers on remove (no CVSS, Linux)
- [CVE-2026-97994](https://cve.now/CVE-2026-97994.md): vhost/vdpa: reject VRING\_NUM larger than device max (no CVSS, Linux)
- [CVE-2026-97993](https://cve.now/CVE-2026-97993.md): vhost-vdpa: don't install the eventfd\_ctx\_fdget() error in config\_ctx (no CVSS, Linux)
- [CVE-2026-97992](https://cve.now/CVE-2026-97992.md): vhost-vdpa: protect config\_ctx from being freed under the config callback (no CVSS, Linux)
- [CVE-2026-97991](https://cve.now/CVE-2026-97991.md): vdpa\_sim\_blk: reject out-of-range sector starts (CVSS 7.8, Linux)
- [CVE-2026-97990](https://cve.now/CVE-2026-97990.md): vdpa\_sim\_net: check TX pull result before RX copy (CVSS 7.5, Linux)
- [CVE-2026-97989](https://cve.now/CVE-2026-97989.md): vduse: validate virtqueue alignment (no CVSS, Linux)
- [CVE-2026-97988](https://cve.now/CVE-2026-97988.md): vhost: invalidate vring access on IOTLB transitions (no CVSS, Linux)
- [CVE-2026-97987](https://cve.now/CVE-2026-97987.md): virtio\_input: reset device if input\_register\_device() fails (no CVSS, Linux)
- [CVE-2026-97986](https://cve.now/CVE-2026-97986.md): virtio\_input: stop callbacks before unregistering input device (no CVSS, Linux)
- [CVE-2026-97985](https://cve.now/CVE-2026-97985.md): af\_unix: Update last skb marker in manage\_oob(). (no CVSS, Linux)
- [CVE-2026-97984](https://cve.now/CVE-2026-97984.md): net: ipv6: Fix UDP length overflow with PMTU discover and big MTU (no CVSS, Linux)
- [CVE-2026-97983](https://cve.now/CVE-2026-97983.md): vduse: return compat ioctl results directly (no CVSS, Linux)
- [CVE-2026-97982](https://cve.now/CVE-2026-97982.md): net: ethernet: cortina: Fix budget accounting (no CVSS, Linux)
- [CVE-2026-97981](https://cve.now/CVE-2026-97981.md): net: ethernet: cortina: Count dropped frames as NAPI work (no CVSS, Linux)
- [CVE-2026-97980](https://cve.now/CVE-2026-97980.md): s390/debug: Fix NULL pointer dereference in debug\_set\_level() (no CVSS, Linux)
- [CVE-2026-97979](https://cve.now/CVE-2026-97979.md): ice: add missing xa\_destroy for sched\_node\_ids (no CVSS, Linux)
- [CVE-2026-97978](https://cve.now/CVE-2026-97978.md): eth: ice: don't dereference pointers from TP\_printk() (no CVSS, Linux)
- [CVE-2026-97977](https://cve.now/CVE-2026-97977.md): Bluetooth: btusb: Fix UAF of btusb\_data by rx\_work (no CVSS, Linux)
- [CVE-2026-97976](https://cve.now/CVE-2026-97976.md): Bluetooth: btintel\_pcie: validate packet\_len before skb\_put\_data (no CVSS, Linux)
- [CVE-2026-97975](https://cve.now/CVE-2026-97975.md): Bluetooth: hci\_sysfs: Fix NULL pointer dereference in device\_del() (no CVSS, Linux)
- [CVE-2026-97974](https://cve.now/CVE-2026-97974.md): ipv6: null-check fib6\_node before accessing in \_\_ip6\_del\_rt\_siblings() (no CVSS, Linux)
- [CVE-2026-97973](https://cve.now/CVE-2026-97973.md): net: macb: destroy the phylink instance on the probe error path (no CVSS, Linux)
- [CVE-2026-97972](https://cve.now/CVE-2026-97972.md): net: macb: put the "mdio" child node reference on success (no CVSS, Linux)
- [CVE-2026-97971](https://cve.now/CVE-2026-97971.md): nstree: check listing permission before taking a namespace reference (CVSS 7.8, Linux)
- [CVE-2026-97970](https://cve.now/CVE-2026-97970.md): watchdog: msc313e: Avoid division by zero (no CVSS, Linux)
- [CVE-2026-97969](https://cve.now/CVE-2026-97969.md): watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (no CVSS, Linux)
- [CVE-2026-97968](https://cve.now/CVE-2026-97968.md): hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (no CVSS, Linux)
- [CVE-2026-97967](https://cve.now/CVE-2026-97967.md): hwmon: (corsair-cpro) Remove debugfs entries when probe fails (no CVSS, Linux)
- [CVE-2026-97966](https://cve.now/CVE-2026-97966.md): octeontx2-pf: reset HTB scheduler topology before freeing queues (no CVSS, Linux)
- [CVE-2026-97965](https://cve.now/CVE-2026-97965.md): vxlan: initialize \_md in vxlan\_xmit\_one() (no CVSS, Linux)
- [CVE-2026-97964](https://cve.now/CVE-2026-97964.md): ppp\_synctty: ensure a writeable skb header (no CVSS, Linux)
- [CVE-2026-97963](https://cve.now/CVE-2026-97963.md): net: stmmac: initialize ptp\_lock at probe time (no CVSS, Linux)
- [CVE-2026-97962](https://cve.now/CVE-2026-97962.md): net/mlx5e: Move representor vnic reporter to eswitch devlink port (no CVSS, Linux)
- [CVE-2026-97961](https://cve.now/CVE-2026-97961.md): perf/core: Allow list\_del during perf\_event\_overflow() (no CVSS, Linux)
- [CVE-2026-97960](https://cve.now/CVE-2026-97960.md): perf/x86/intel: Prevent drain\_pebs() reentry (no CVSS, Linux)
- [CVE-2026-97959](https://cve.now/CVE-2026-97959.md): net/sched: cls\_route: free emptied bucket on filter move (no CVSS, Linux)
- [CVE-2026-97958](https://cve.now/CVE-2026-97958.md): net/sched: cls\_api: Don't replay RTM\_GETCHAIN in tc\_ctl\_chain(). (no CVSS, Linux)
- [CVE-2026-97957](https://cve.now/CVE-2026-97957.md): net: hinic: fix mailbox segment buffer overflow (CVSS 8.8, Linux)
- [CVE-2026-97956](https://cve.now/CVE-2026-97956.md): net: net\_failover: Fix the deadlock in net\_failover\_slave\_name\_change() (no CVSS, Linux)
- [CVE-2026-97955](https://cve.now/CVE-2026-97955.md): net: mana: restore the XDP program pointer when pre-allocation fails (no CVSS, Linux)
- [CVE-2026-97954](https://cve.now/CVE-2026-97954.md): net/rds: fix tcp stream corruption with large pages (no CVSS, Linux)
- [CVE-2026-97953](https://cve.now/CVE-2026-97953.md): net: stmmac: fix TX descriptor availability check for TSO traffic (CVSS 7.0, Linux)
- [CVE-2026-97952](https://cve.now/CVE-2026-97952.md): sunvdc: unmap LDC cookies when the descriptor send fails (no CVSS, Linux)
- [CVE-2026-97951](https://cve.now/CVE-2026-97951.md): scsi: target: iscsi: Fix hang for aborted WRITE\_PENDING commands (no CVSS, Linux)
- [CVE-2026-97950](https://cve.now/CVE-2026-97950.md): configfs: pin the symlink target's dirent instead of chasing -\>ci\_dentry (no CVSS, Linux)
- [CVE-2026-97949](https://cve.now/CVE-2026-97949.md): configfs: unhash the dentry before dropping the item in rmdir (no CVSS, Linux)
- [CVE-2026-97948](https://cve.now/CVE-2026-97948.md): powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver (no CVSS, Linux)
- [CVE-2026-97947](https://cve.now/CVE-2026-97947.md): x86/amd\_node: Fix potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2026-97946](https://cve.now/CVE-2026-97946.md): x86/amd\_node: Fix PCI device reference counting in amd\_smn\_init() (no CVSS, Linux)
- [CVE-2026-97945](https://cve.now/CVE-2026-97945.md): x86/mm: Fix user-space data loss with MADV\_FREE and THP (no CVSS, Linux)
- [CVE-2026-97944](https://cve.now/CVE-2026-97944.md): x86/cfi: Fix FineIBT hash offset in cfi\_get\_func\_hash() (no CVSS, Linux)
- [CVE-2026-97943](https://cve.now/CVE-2026-97943.md): x86/mm/pat: Acquire init\_mm write lock on collapse to avoid UAF (no CVSS, Linux)
- [CVE-2026-97942](https://cve.now/CVE-2026-97942.md): x86/alternatives: Exclude text poking against change\_page\_attr() (no CVSS, Linux)
- [CVE-2026-97941](https://cve.now/CVE-2026-97941.md): mm/slab: take n-\>list\_lock in \_\_slab\_try\_return\_freelist() to avoid race (CVSS 7.8, Linux)
- [CVE-2026-97940](https://cve.now/CVE-2026-97940.md): ipv6: fix fib6 walker UAF on seq stop (CVSS 7.8, Linux)
- [CVE-2026-97939](https://cve.now/CVE-2026-97939.md): ipmr: account multicast table and route memory (no CVSS, Linux)
- [CVE-2026-97938](https://cve.now/CVE-2026-97938.md): reboot: fix cad\_pid use-after-free race (no CVSS, Linux)
- [CVE-2026-97937](https://cve.now/CVE-2026-97937.md): ftrace: fork: Initialize function graph state before copy\_exec\_state() (CVSS 7.8, Linux)
- [CVE-2026-97936](https://cve.now/CVE-2026-97936.md): tracing: Fix memory corruption from the histogram stacktrace modifier (no CVSS, Linux)
- [CVE-2026-97935](https://cve.now/CVE-2026-97935.md): tracing: Set the trace clock before registering the histogram trigger (no CVSS, Linux)
- [CVE-2026-97934](https://cve.now/CVE-2026-97934.md): tracing: Fix memory corruption from a "STACKTRACE" histogram key (no CVSS, Linux)
- [CVE-2026-97933](https://cve.now/CVE-2026-97933.md): tracing: Take trace\_array reference when opening a tracer options file (no CVSS, Linux)
- [CVE-2026-97932](https://cve.now/CVE-2026-97932.md): tracing: Don't dereference trace\_event\_file in deferred trigger free (no CVSS, Linux)
- [CVE-2026-97931](https://cve.now/CVE-2026-97931.md): ALSA: us122l: Prevent write upgrades for read mappings (CVSS 7.0, Linux)
- [CVE-2026-97930](https://cve.now/CVE-2026-97930.md): ALSA: usbusx2y: fix in04\_last array size mismatch with in04\_buf (no CVSS, Linux)
- [CVE-2026-97929](https://cve.now/CVE-2026-97929.md): ALSA: usbusx2y: validate URB actual\_length in interrupt callback (no CVSS, Linux)
- [CVE-2026-97928](https://cve.now/CVE-2026-97928.md): drm/amdgpu: skip the VMID 0 flush for VRAM (no CVSS, Linux)
- [CVE-2026-97927](https://cve.now/CVE-2026-97927.md): ufs: create the root dentry after loading cylinder metadata (no CVSS, Linux)
- [CVE-2026-97926](https://cve.now/CVE-2026-97926.md): ufs: validate cylinder group metadata before caching it (CVSS 7.0, Linux)
- [CVE-2026-97925](https://cve.now/CVE-2026-97925.md): tick/broadcast: Plug clockevents replacement race (no CVSS, Linux)
- [CVE-2026-97924](https://cve.now/CVE-2026-97924.md): tracing/user\_events: Don't destroy fields when event removal fails (no CVSS, Linux)
- [CVE-2026-97923](https://cve.now/CVE-2026-97923.md): tracing: Free histogram the var ref when its initialization fails (no CVSS, Linux)
- [CVE-2026-97922](https://cve.now/CVE-2026-97922.md): tracing: Free histogram var refs regardless of how often they are referenced (no CVSS, Linux)
- [CVE-2026-97921](https://cve.now/CVE-2026-97921.md): tracing: Free histogram the field rejected for a bad modifier (no CVSS, Linux)
- [CVE-2026-97920](https://cve.now/CVE-2026-97920.md): tracing: Keep the entry count when the histogram stats allocation fails (no CVSS, Linux)
- [CVE-2026-97919](https://cve.now/CVE-2026-97919.md): tracing: Take the reference before publishing the named histogram trigger (no CVSS, Linux)
- [CVE-2026-97918](https://cve.now/CVE-2026-97918.md): tracing: Undo the registration when enabling the histogram trigger fails (no CVSS, Linux)
- [CVE-2026-97917](https://cve.now/CVE-2026-97917.md): accel/ivpu: Validate full buffer range in ivpu\_to\_cpu\_addr (no CVSS, Linux)
- [CVE-2026-97916](https://cve.now/CVE-2026-97916.md): accel/ivpu: Validate firmware log buffer metadata (no CVSS, Linux)
- [CVE-2026-97915](https://cve.now/CVE-2026-97915.md): accel/ivpu: Limit firmware log name prints to field size (no CVSS, Linux)
- [CVE-2026-97914](https://cve.now/CVE-2026-97914.md): accel: ethosu: Fix ethosu\_job\_open() return value (no CVSS, Linux)
- [CVE-2026-97913](https://cve.now/CVE-2026-97913.md): accel: ethosu: Ensure cmd stream ends with a stop op (no CVSS, Linux)
- [CVE-2026-97912](https://cve.now/CVE-2026-97912.md): accel: ethosu: Ensure SRAM size is 0 on mapping failure (no CVSS, Linux)
- [CVE-2026-97911](https://cve.now/CVE-2026-97911.md): accel: ethosu: Ensure SRAM region size matches job (CVSS 7.8, Linux)
- [CVE-2026-97910](https://cve.now/CVE-2026-97910.md): ASoC: sprd: validate compress buffer sizes against fixed allocations (CVSS 7.8, Linux)
- [CVE-2026-97909](https://cve.now/CVE-2026-97909.md): ASoC: sti: initialize IRQ lock before requesting IRQ (no CVSS, Linux)
- [CVE-2026-97908](https://cve.now/CVE-2026-97908.md): Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci\_dev (no CVSS, Linux)
- [CVE-2026-97907](https://cve.now/CVE-2026-97907.md): Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (no CVSS, Linux)
- [CVE-2026-97906](https://cve.now/CVE-2026-97906.md): bootconfig: Fix integer overflow in initrd size check (no CVSS, Linux)
- [CVE-2026-97905](https://cve.now/CVE-2026-97905.md): cpufreq: zero-initialize policy cpumask before sysfs publication (no CVSS, Linux)
- [CVE-2026-97904](https://cve.now/CVE-2026-97904.md): cpufreq: initialize policy rwsem before sysfs publication (no CVSS, Linux)
- [CVE-2026-97903](https://cve.now/CVE-2026-97903.md): exit: hold a reference to thread\_pid across proc\_flush\_pid (CVSS 7.8, Linux)
- [CVE-2026-97902](https://cve.now/CVE-2026-97902.md): fs: don't return -EINVAL for successful nested thaw (no CVSS, Linux)
- [CVE-2026-97901](https://cve.now/CVE-2026-97901.md): genetlink: pin family module during policy dump (no CVSS, Linux)
- [CVE-2026-97900](https://cve.now/CVE-2026-97900.md): drm/drm\_exec: fix up contended obj when num\_objects is 0 (no CVSS, Linux)
- [CVE-2026-97899](https://cve.now/CVE-2026-97899.md): drm/i915: Fix memory leak in query\_perf\_config\_list() (no CVSS, Linux)
- [CVE-2026-97621](https://cve.now/CVE-2026-97621.md): drm/rockchip: analogix\_dp: fix unchecked bound endpoint name length (no CVSS, Linux)
- [CVE-2026-97620](https://cve.now/CVE-2026-97620.md): drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches (no CVSS, Linux)
- [CVE-2026-97619](https://cve.now/CVE-2026-97619.md): io\_uring/rw: end write accounting from -\>ki\_complete (no CVSS, Linux)
- [CVE-2026-97618](https://cve.now/CVE-2026-97618.md): io\_uring/net: don't overconsume buffers when using MSG\_TRUNC (no CVSS, Linux)
- [CVE-2026-97617](https://cve.now/CVE-2026-97617.md): ring-buffer: Check resize\_disabled before publishing the new subbuf order (no CVSS, Linux)
- [CVE-2026-97616](https://cve.now/CVE-2026-97616.md): net/sched: act\_api: release all action references on NEWACTION failure (no CVSS, Linux)
- [CVE-2026-97615](https://cve.now/CVE-2026-97615.md): net: bridge: use option bits for CFM/MRP frame handlers (no CVSS, Linux)
- [CVE-2026-97614](https://cve.now/CVE-2026-97614.md): net: dsa: tag\_brcm: legacy FCS: request needed tailroom (no CVSS, Linux)
- [CVE-2026-97613](https://cve.now/CVE-2026-97613.md): net: mana: Reserve extra CQ slot for the fence completion CQE (no CVSS, Linux)
- [CVE-2026-97612](https://cve.now/CVE-2026-97612.md): net: mpls: clear inner\_protocol when the last label is popped (CVSS 7.8, Linux)
- [CVE-2026-97611](https://cve.now/CVE-2026-97611.md): net: openvswitch: fix use-after-free of the flow table mask array (CVSS 7.8, Linux)
- [CVE-2026-97610](https://cve.now/CVE-2026-97610.md): netfs: Fix uninitialized return value in netfs\_unbuffered\_write() (no CVSS, Linux)
- [CVE-2026-97609](https://cve.now/CVE-2026-97609.md): netfilter: cttimeout: prevent UAF during module unload (CVSS 7.0, Linux)
- [CVE-2026-97608](https://cve.now/CVE-2026-97608.md): netfilter: nf\_log: unregister loggers before per-net teardown (CVSS 7.0, Linux)
- [CVE-2026-97607](https://cve.now/CVE-2026-97607.md): vdpa: ifcvf: Put device on unsupported feature error (no CVSS, Linux)
- [CVE-2026-97606](https://cve.now/CVE-2026-97606.md): fs: autofs: fix memory leak in autofs\_fill\_super() (no CVSS, Linux)
- [CVE-2026-97605](https://cve.now/CVE-2026-97605.md): erofs: preserve LZMA decoders on resize failure (no CVSS, Linux)
- [CVE-2026-97604](https://cve.now/CVE-2026-97604.md): fbdev: vfb: defer cleanup until the last reference (no CVSS, Linux)
- [CVE-2026-97603](https://cve.now/CVE-2026-97603.md): idpf: disable DIM work before freeing q\_vectors (no CVSS, Linux)
- [CVE-2026-97602](https://cve.now/CVE-2026-97602.md): inet: frags: invalidate queues before flushing them (CVSS 7.8, Linux)
- [CVE-2026-97601](https://cve.now/CVE-2026-97601.md): ieee802154: 6lowpan: fix NULL dereference in lowpan\_newlink (no CVSS, Linux)
- [CVE-2026-97600](https://cve.now/CVE-2026-97600.md): ieee802154: cc2520: fix FIFOP work use-after-free (no CVSS, Linux)
- [CVE-2026-97599](https://cve.now/CVE-2026-97599.md): ieee802154: hwsim: serialize pib updates to fix double-free (no CVSS, Linux)
- [CVE-2026-97598](https://cve.now/CVE-2026-97598.md): ipv4: fib: bound automatic table ID allocation (no CVSS, Linux)
- [CVE-2026-97597](https://cve.now/CVE-2026-97597.md): ipv6: flowlabel: cap duplicate leases per socket (no CVSS, Linux)
- [CVE-2026-97596](https://cve.now/CVE-2026-97596.md): ipvs: reject invalid states in connection template sync records (no CVSS, Linux)
- [CVE-2026-97595](https://cve.now/CVE-2026-97595.md): mac802154: fix use-after-free of sdata via queued RX frames (CVSS 7.5, Linux)
- [CVE-2026-97594](https://cve.now/CVE-2026-97594.md): landlock: Fix use-after-free of the source's parent directory (CVSS 7.8, Linux)
- [CVE-2026-97593](https://cve.now/CVE-2026-97593.md): iommu/s390: Fix NULL dereference in iova\_to\_phys() with ZPCI\_TABLE\_TYPE\_RFX (no CVSS, Linux)
- [CVE-2026-97592](https://cve.now/CVE-2026-97592.md): s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm (no CVSS, Linux)
- [CVE-2026-97591](https://cve.now/CVE-2026-97591.md): s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine (no CVSS, Linux)
- [CVE-2026-97590](https://cve.now/CVE-2026-97590.md): s390/crypto: Fix missing scrub of temp buffers with PAES algorithm (no CVSS, Linux)
- [CVE-2026-97589](https://cve.now/CVE-2026-97589.md): s390/crypto: Fix wrong return code to engine in asynch callbacks (CVSS 7.0, Linux)
- [CVE-2026-97588](https://cve.now/CVE-2026-97588.md): s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly (no CVSS, Linux)
- [CVE-2026-97587](https://cve.now/CVE-2026-97587.md): perf: RISC-V: store available counter mask as bitmap (no CVSS, Linux)
- [CVE-2026-97586](https://cve.now/CVE-2026-97586.md): afs: Fix missing kunmap in afs\_dir\_search\_bucket() (no CVSS, Linux)
- [CVE-2026-97585](https://cve.now/CVE-2026-97585.md): afs: Fix double-unmap of directory block (no CVSS, Linux)
- [CVE-2026-97584](https://cve.now/CVE-2026-97584.md): afs: Fix incorrect free in candidate cleanup in afs\_lookup\_server() (CVSS 7.8, Linux)
- [CVE-2026-97583](https://cve.now/CVE-2026-97583.md): afs: Clear stale peer app data after address list changes (CVSS 7.5, Linux)
- [CVE-2026-97582](https://cve.now/CVE-2026-97582.md): hwmon: (gpio-fan) Fix use-after-free in alarm work (no CVSS, Linux)
- [CVE-2026-97581](https://cve.now/CVE-2026-97581.md): media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (no CVSS, Linux)
- [CVE-2026-97580](https://cve.now/CVE-2026-97580.md): media: rkvdec: bound HEVC tile loops and PPS id to the array capacity (CVSS 7.8, Linux)
- [CVE-2026-97579](https://cve.now/CVE-2026-97579.md): media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (CVSS 7.8, Linux)
- [CVE-2026-97578](https://cve.now/CVE-2026-97578.md): media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (CVSS 7.8, Linux)
- [CVE-2026-97577](https://cve.now/CVE-2026-97577.md): media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (CVSS 7.8, Linux)
- [CVE-2026-97576](https://cve.now/CVE-2026-97576.md): media: v4l2-ctrls: validate HEVC tile counts (CVSS 7.8, Linux)
- [CVE-2026-97575](https://cve.now/CVE-2026-97575.md): media: v4l2-ctrls: validate AV1 tile counts (CVSS 7.8, Linux)
- [CVE-2026-97574](https://cve.now/CVE-2026-97574.md): bnxt\_en: Don't free the live ring's TPA state on queue restart failure (no CVSS, Linux)
- [CVE-2026-97573](https://cve.now/CVE-2026-97573.md): bnxt\_en: Handle buffer allocation failure in bnxt\_rx\_ring\_reset() (CVSS 8.1, Linux)
- [CVE-2026-97572](https://cve.now/CVE-2026-97572.md): bnxt\_en: Propagate RX ring init failures in bnxt\_init\_nic() (no CVSS, Linux)
- [CVE-2026-97571](https://cve.now/CVE-2026-97571.md): bnxt\_en: Propagate TPA buffer allocation failures in bnxt\_queue\_mem\_alloc() (no CVSS, Linux)
- [CVE-2026-97570](https://cve.now/CVE-2026-97570.md): bnxt\_en: Bound SW TPA IDs to prevent crashes (CVSS 8.1, Linux)
- [CVE-2026-97569](https://cve.now/CVE-2026-97569.md): bnxt\_en: Prevent queue stop with deferred completions (no CVSS, Linux)
- [CVE-2026-97568](https://cve.now/CVE-2026-97568.md): mptcp: syncookies: remember the request backup flag (no CVSS, Linux)
- [CVE-2026-97567](https://cve.now/CVE-2026-97567.md): mptcp: prevent race between disconnect() and rtx (no CVSS, Linux)
- [CVE-2026-97566](https://cve.now/CVE-2026-97566.md): mptcp: pm: kernel: drop pending ADD\_ADDR when removing ID0 (no CVSS, Linux)
- [CVE-2026-97565](https://cve.now/CVE-2026-97565.md): smb: client: reject short READ responses in CIFSSMBRead() (no CVSS, Linux)
- [CVE-2026-97564](https://cve.now/CVE-2026-97564.md): smb: client: reject userspace cifs.idmap descriptions (no CVSS, Linux)
- [CVE-2026-97563](https://cve.now/CVE-2026-97563.md): smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (no CVSS, Linux)
- [CVE-2026-97562](https://cve.now/CVE-2026-97562.md): smb: client: pin DFS superblock in iterator callback (CVSS 7.5, Linux)
- [CVE-2026-97561](https://cve.now/CVE-2026-97561.md): smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid (no CVSS, Linux)
- [CVE-2026-97560](https://cve.now/CVE-2026-97560.md): smb: client: fix one-byte OOB read in smb2\_parse\_native\_symlink() (no CVSS, Linux)
- [CVE-2026-97559](https://cve.now/CVE-2026-97559.md): smb: client: fail DACL rewrite when the new DACL exceeds 64K (no CVSS, Linux)
- [CVE-2026-97558](https://cve.now/CVE-2026-97558.md): smb: client: fix cifsFileInfo reference leak in deferred close (no CVSS, Linux)
- [CVE-2026-97557](https://cve.now/CVE-2026-97557.md): smb: client: avoid leaking refcount in cifs\_queue\_oplock\_break() (CVSS 7.5, Linux)
- [CVE-2026-97556](https://cve.now/CVE-2026-97556.md): smb: client: avoid leaking refcount when cifs\_sb\_tlink() fails (no CVSS, Linux)
- [CVE-2026-97555](https://cve.now/CVE-2026-97555.md): smb: client: fix heap overflow in DACL owner/group rewrite (CVSS 8.8, Linux)
- [CVE-2026-97554](https://cve.now/CVE-2026-97554.md): smb: client: avoid using uninitialized SIDs in cifs\_posix\_to\_fattr() (no CVSS, Linux)
- [CVE-2026-97553](https://cve.now/CVE-2026-97553.md): xfs: lock the healthmon when inserting unmount event (no CVSS, Linux)
- [CVE-2026-97552](https://cve.now/CVE-2026-97552.md): xfs: initialise error in xfs\_defer\_finish\_one() (no CVSS, Linux)
- [CVE-2026-97551](https://cve.now/CVE-2026-97551.md): xfs: initialise args-\>total for parent pointer updates (no CVSS, Linux)
- [CVE-2026-97550](https://cve.now/CVE-2026-97550.md): xfs: fix unit conversions in per\_binval computation (no CVSS, Linux)
- [CVE-2026-97549](https://cve.now/CVE-2026-97549.md): xfs: fix under-reservation of blocks when repairing sf directories (no CVSS, Linux)
- [CVE-2026-97548](https://cve.now/CVE-2026-97548.md): xfs: fix the rtrmap and rtrefcount \_maxlevels\_ondisk functions (CVSS 7.8, Linux)
- [CVE-2026-97547](https://cve.now/CVE-2026-97547.md): xfs: fix exchange-range reflink flag clearing issue with INO1\_WRITTEN (no CVSS, Linux)
- [CVE-2026-97546](https://cve.now/CVE-2026-97546.md): xfs: don't spin forever on zero-length dirents when salvaging them (no CVSS, Linux)
- [CVE-2026-97545](https://cve.now/CVE-2026-97545.md): xfs: don't leak new\_bp if xfs\_btree\_bload\_drop\_buf fails (no CVSS, Linux)
- [CVE-2026-97544](https://cve.now/CVE-2026-97544.md): xfs: don't leak dqacct if rhashtable insertion fails (no CVSS, Linux)
- [CVE-2026-97543](https://cve.now/CVE-2026-97543.md): xfs: destroy seen inode bitmap when we fail to add a dirpath (no CVSS, Linux)
- [CVE-2026-97542](https://cve.now/CVE-2026-97542.md): xfs: bail out on bitmap errors in xrep\_agfl\_fill (no CVSS, Linux)
- [CVE-2026-97541](https://cve.now/CVE-2026-97541.md): wifi: ath9k\_htc: don't store usb\_device\_id (no CVSS, Linux)
- [CVE-2026-97540](https://cve.now/CVE-2026-97540.md): net: usb: pegasus: don't rely on id table pointer arithmetic (no CVSS, Linux)
- [CVE-2026-97539](https://cve.now/CVE-2026-97539.md): usb: xusbatm: don't rely on id table pointer arithmetic (no CVSS, Linux)
- [CVE-2026-97538](https://cve.now/CVE-2026-97538.md): hwmon: (asus\_rog\_ryujin) Validate HID report lengths (no CVSS, Linux)
- [CVE-2026-97537](https://cve.now/CVE-2026-97537.md): scsi: qla2xxx: Fix queue teardown NULL dma\_free and bitmap locking (no CVSS, Linux)
- [CVE-2026-97536](https://cve.now/CVE-2026-97536.md): scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown (CVSS 7.5, Linux)
- [CVE-2026-97535](https://cve.now/CVE-2026-97535.md): scsi: qla2xxx: Bound VP index against VP\_CTRL IOCB bitmap size (no CVSS, Linux)
- [CVE-2026-97534](https://cve.now/CVE-2026-97534.md): f2fs: accurately adjust free\_sections during free\_segment\_range (no CVSS, Linux)
- [CVE-2026-97533](https://cve.now/CVE-2026-97533.md): x86/mm/pat: Acquire init\_mm read lock on attribute changes to avoid UAF (no CVSS, Linux)
- [CVE-2026-97532](https://cve.now/CVE-2026-97532.md): scsi: qla2xxx: Null out freed pointers in qla2x00\_mem\_alloc() error path (no CVSS, Linux)
- [CVE-2026-97531](https://cve.now/CVE-2026-97531.md): scsi: qla2xxx: Skip vport under deletion in report ID acquisition (CVSS 7.5, Linux)
- [CVE-2026-97530](https://cve.now/CVE-2026-97530.md): scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (no CVSS, Linux)
- [CVE-2026-97529](https://cve.now/CVE-2026-97529.md): scsi: qla2xxx: Validate BSG request\_len before reading vendor\_cmd\[\] (no CVSS, Linux)
- [CVE-2026-97528](https://cve.now/CVE-2026-97528.md): scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (CVSS 8.8, Linux)
- [CVE-2026-97527](https://cve.now/CVE-2026-97527.md): scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (CVSS 8.8, Linux)
- [CVE-2026-97526](https://cve.now/CVE-2026-97526.md): s390/pai: Support CPU hotplug for PMU PAI (no CVSS, Linux)
- [CVE-2026-97525](https://cve.now/CVE-2026-97525.md): x86/mm/pat: Allocate split page tables as kernel page tables (CVSS 8.2, Linux)
- [CVE-2026-97524](https://cve.now/CVE-2026-97524.md): mptcp: avoid unneeded actions on subflow reset (CVSS 7.5, Linux)
- [CVE-2026-97523](https://cve.now/CVE-2026-97523.md): mptcp: close race between scheduler and state change (CVSS 7.5, Linux)
- [CVE-2026-97522](https://cve.now/CVE-2026-97522.md): mptcp: fix bad accounting in \_\_mptcp\_subflow\_push\_pending() (no CVSS, Linux)
- [CVE-2026-97898](https://cve.now/CVE-2026-97898.md): Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms (CVSS 8.4, akia)
- [CVE-2026-92106](https://cve.now/CVE-2026-92106.md): lazy\_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS (CVSS 2.3, dashbitco lazy\_html · lazy\_html)
- [CVE-2026-88848](https://cve.now/CVE-2026-88848.md): MasterStudy LMS 1.9 - \< 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass (CVSS 4.2, MasterStudy LMS)
- [CVE-2026-80514](https://cve.now/CVE-2026-80514.md): wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass (CVSS 5.3, wpForo Forum)
- [CVE-2026-6088](https://cve.now/CVE-2026-6088.md): Stored Cross-Site Scripting in StockAgile by Novadigits technologies (CVSS 5.1, Novadigits technologies StockAgile)
- [CVE-2026-6087](https://cve.now/CVE-2026-6087.md): Stored Cross-Site Scripting in StockAgile by Novadigits technologies (CVSS 5.1, Novadigits technologies StockAgile)
- [CVE-2026-6086](https://cve.now/CVE-2026-6086.md): Stored Cross-Site Scripting in StockAgile by Novadigits technologies (CVSS 5.1, Novadigits technologies StockAgile)
- [CVE-2026-6085](https://cve.now/CVE-2026-6085.md): Stored Cross-Site Scripting in StockAgile by Novadigits technologies (CVSS 5.1, Novadigits technologies StockAgile)
- [CVE-2026-86837](https://cve.now/CVE-2026-86837.md): Bookly \< 28.3 - Unauthenticated Customer PII Update via Verification Bypass (CVSS 5.3, Bookly)
- [CVE-2026-6084](https://cve.now/CVE-2026-6084.md): Stored Cross-Site Scripting in StockAgile by Novadigits technologies (CVSS 5.1, Novadigits technologies StockAgile)
- [CVE-2026-6083](https://cve.now/CVE-2026-6083.md): Stored Cross-Site Scripting in StockAgile by Novadigits technologies (CVSS 5.1, Novadigits technologies StockAgile)
- [CVE-2026-6082](https://cve.now/CVE-2026-6082.md): Stored Cross-Site Scripting in StockAgile by Novadigits technologies (CVSS 5.1, Novadigits technologies StockAgile)
- [CVE-2026-92550](https://cve.now/CVE-2026-92550.md): Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder (CVSS 7.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-92560](https://cve.now/CVE-2026-92560.md): Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder (CVSS 7.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-92573](https://cve.now/CVE-2026-92573.md): Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering (CVSS 6.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-97863](https://cve.now/CVE-2026-97863.md): misp-modules: Shell Command Injection in MISP cisco\_firesight\_manager\_ACL\_rule\_export Module via Unescaped Attribute Values (CVSS 6.3, misp-modules)
- [CVE-2026-92564](https://cve.now/CVE-2026-92564.md): Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing (CVSS 7.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-92608](https://cve.now/CVE-2026-92608.md): Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 (CVSS 7.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-92609](https://cve.now/CVE-2026-92609.md): Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication (CVSS 9.8, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-95864](https://cve.now/CVE-2026-95864.md): Themify Builder \<= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css\[fonts\]' Parameter (CVSS 7.2, themifyme Themify Builder)
- [CVE-2026-89426](https://cve.now/CVE-2026-89426.md): Knit Pay \<= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field (CVSS 8.8, knitpay Knit Pay – Cashfree, Instamojo, Razorpay, PayPal an…)
- [CVE-2026-94573](https://cve.now/CVE-2026-94573.md): Repeater Fields for Elementor Forms \<= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value (CVSS 7.2, addonsorg Repeater Fields for Elementor Forms)
- [CVE-2026-19804](https://cve.now/CVE-2026-19804.md): s2Member \<= 260814 - Unauthenticated Remote Code Execution via 'first\_name' Parameter in PayPal Proxy Return (CVSS 8.8, clavaque s2Member – Excellent for All Kinds of Memberships,…)
- [CVE-2026-84280](https://cve.now/CVE-2026-84280.md): Fancy Product Designer \<= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements\[\].title' Parameter (CVSS 7.2, radykal Fancy Product Designer)
- [CVE-2026-12037](https://cve.now/CVE-2026-12037.md): Asset CleanUp: Page Speed Booster \<= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page\_url' Parameter (CVSS 5.5, gabelivan Asset CleanUp: Page Speed Booster)
- [CVE-2026-89406](https://cve.now/CVE-2026-89406.md): Modula Image Gallery \<= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula\_gallery\_id' and 'modula\_image\_id' Parameters (CVSS 7.5, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2026-93901](https://cve.now/CVE-2026-93901.md): Optima Express IDX \<= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf\_clear\_cache' AJAX Action to Author Role Assignment (CVSS 7.3, ihomefinder Optima Express IDX)
- [CVE-2026-13179](https://cve.now/CVE-2026-13179.md): WP Maps \<= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes\_values Parameter (CVSS 6.4, flippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, S…)
- [CVE-2026-17602](https://cve.now/CVE-2026-17602.md): SSL Zen \<= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file\_name' Parameter (CVSS 4.9, sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects)
- [CVE-2026-95866](https://cve.now/CVE-2026-95866.md): User Profile Builder \<= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field (CVSS 7.2, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2026-96568](https://cve.now/CVE-2026-96568.md): Restaurant Menu and Food Ordering \<= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone\_number' Parameter (CVSS 7.2, jetmonsters Restaurant Menu and Food Ordering)
- [CVE-2026-93656](https://cve.now/CVE-2026-93656.md): User Profile Builder \<= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field (CVSS 6.4, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2026-13456](https://cve.now/CVE-2026-13456.md): WP Maps \<= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter (CVSS 7.5, flippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, S…)
- [CVE-2026-93654](https://cve.now/CVE-2026-93654.md): Premium Packages \<= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart\_items\[\]\[product\_name\]' Parameter (CVSS 7.2, codename065 Premium Packages – Sell Digital Products Secure…)
- [CVE-2026-17577](https://cve.now/CVE-2026-17577.md): SSL Zen \<= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter (CVSS 6.1, sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects)
- [CVE-2026-92713](https://cve.now/CVE-2026-92713.md): Modula Image Gallery \<= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter (CVSS 8.1, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2026-93747](https://cve.now/CVE-2026-93747.md): wpForo Forum \<= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field (CVSS 6.4, tomdever wpForo Forum)
- [CVE-2026-88996](https://cve.now/CVE-2026-88996.md): WPForms \<= 2.0.2 - Reflected Cross-Site Scripting via 'page\_title' POST Parameter (CVSS 6.1, smub WPForms – AI Form Builder for WordPress – Contact Form…)
- [CVE-2026-96752](https://cve.now/CVE-2026-96752.md): Zero Spam for WordPress \<= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration (CVSS 7.2, bmarshall511 Zero Spam for WordPress)
- [CVE-2026-96448](https://cve.now/CVE-2026-96448.md): Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation (CVSS 6.6, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-93477](https://cve.now/CVE-2026-93477.md): Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash (CVSS 5.9, ash-project ash · ash)
- [CVE-2026-94376](https://cve.now/CVE-2026-94376.md): Better Messages \<= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name (CVSS 6.4, wordplus Better Messages – Chat Rooms, Group Chat, Private…)
- [CVE-2026-14281](https://cve.now/CVE-2026-14281.md): Automation Web Platform \<= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp\_custom\_fields' Parameter (CVSS 9.8, 101gen Automation Web Platform – Notifications and OTP for…)
- [CVE-2026-92746](https://cve.now/CVE-2026-92746.md): Gutenverse \<= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute (CVSS 6.4, jegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…)
- [CVE-2026-96039](https://cve.now/CVE-2026-96039.md): BA Book Everything \<= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first\_name Parameter (CVSS 7.2, bookingalgorithms BA Book Everything)
- [CVE-2026-93303](https://cve.now/CVE-2026-93303.md): HT Contact Form \<= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form\_data' Rich Text Field via Draft Save/Resume (CVSS 7.2, htplugins HT Contact Form – Drag & Drop Form Builder for Wo…)
- [CVE-2026-93399](https://cve.now/CVE-2026-93399.md): Online Scheduling and Appointment Booking System \<= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order\_id' Parameter (CVSS 9.1, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-92799](https://cve.now/CVE-2026-92799.md): Online Scheduling and Appointment Booking System \<= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification\_code' Parameter Type Juggling via json\_data (CVSS 5.3, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-92829](https://cve.now/CVE-2026-92829.md): Blog2Social: Social Media Auto Post & Scheduler \<= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers (CVSS 4.3, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2026-96766](https://cve.now/CVE-2026-96766.md): GeoDirectory \<= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business\_hours' Parameter (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-89055](https://cve.now/CVE-2026-89055.md): Customer Reviews for WooCommerce \<= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items\[\]\[media\]' Parameter (CVSS 9.1, ivole Customer Reviews for WooCommerce)
- [CVE-2026-19775](https://cve.now/CVE-2026-19775.md): OpenStation \<= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint (CVSS 4.3, allterraindeveloper OpenStation: Desktop Windows, Dock & Vi…)
- [CVE-2026-84279](https://cve.now/CVE-2026-84279.md): Fancy Product Designer \<= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output\_format' Parameter via Pro Export Print Job (CVSS 7.2, radykal Fancy Product Designer)
- [CVE-2026-93899](https://cve.now/CVE-2026-93899.md): Better Messages \<= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group\_id' Message Meta Parameter (CVSS 6.5, wordplus Better Messages – Chat Rooms, Group Chat, Private…)
- [CVE-2026-84281](https://cve.now/CVE-2026-84281.md): Fancy Product Designer \<= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '\_fpd\_data' Order Item Meta (CVSS 7.2, radykal Fancy Product Designer)
- [CVE-2026-83591](https://cve.now/CVE-2026-83591.md): AMP for WP \<= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation (CVSS 7.2, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2026-92212](https://cve.now/CVE-2026-92212.md): JetFormBuilder \<= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb\_xss' (URL Query Variable) Parameter via Calculated Field (CVSS 6.1, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-93897](https://cve.now/CVE-2026-93897.md): GeoDirectory \<= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-62062](https://cve.now/CVE-2026-62062.md): WordPress Elementor Website Builder plugin \<= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Elementor Website Builder)
- [CVE-2026-75553](https://cve.now/CVE-2026-75553.md): Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a (CVSS 2.4, Tohoku Electric Power Company, Incorporated Tohoku Electric…)
- [CVE-2026-97846](https://cve.now/CVE-2026-97846.md): Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding (CVSS 6.8, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-78397](https://cve.now/CVE-2026-78397.md): Link Library \< 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation (CVSS 4.0, Link Library)
- [CVE-2026-78394](https://cve.now/CVE-2026-78394.md): Link Library \< 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter (CVSS 4.1, Link Library)
- [CVE-2026-78393](https://cve.now/CVE-2026-78393.md): Link Library \< 7.9.6 - Reflected XSS via 'link\_tags' and 'link\_price' Sort and Breadcrumb Links (CVSS 6.1, Link Library)
- [CVE-2026-97721](https://cve.now/CVE-2026-97721.md): Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization (CVSS 5.1, Sanluan PublicCMS)
- [CVE-2026-97818](https://cve.now/CVE-2026-97818.md): phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php. (CVSS 8.6, phpIPAM)
- [CVE-2026-97764](https://cve.now/CVE-2026-97764.md): django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker (CVSS 3.7, django-allauth)
- [CVE-2026-97737](https://cve.now/CVE-2026-97737.md): In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeove (CVSS 7.4, muety Wakapi)
- [CVE-2026-97736](https://cve.now/CVE-2026-97736.md): tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. (CVSS 5.4, tinyauth)
- [CVE-2026-97735](https://cve.now/CVE-2026-97735.md): ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket\_email\_parser.php) for email messages that may arrive over (CVSS 8.0, ITFlow)
- [CVE-2025-14814](https://cve.now/CVE-2025-14814.md): CSS & JavaScript Toolbox \<= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode (CVSS 6.4, wipeoutmedia CSS & JavaScript Toolbox)
- [CVE-2026-97732](https://cve.now/CVE-2026-97732.md): IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and (CVSS 5.1, IRONMACE Ironshield)
- [CVE-2026-97731](https://cve.now/CVE-2026-97731.md): MinIO through 7aac2a2 does not verify that every x-amz-\* header present on a request also appears in the client-supplied X-Amz-SignedHeaders (CVSS 7.1, MinIO)
- [CVE-2026-97730](https://cve.now/CVE-2026-97730.md): In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) wi (CVSS 8.5, Netgate pfSense Plus · Netgate pfSense CE)
- [CVE-2026-97650](https://cve.now/CVE-2026-97650.md): ningzichun student-management-system addLog.php echo cross site scripting (CVSS 5.3, ningzichun student-management-system)
- [CVE-2026-97724](https://cve.now/CVE-2026-97724.md): A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing (CVSS 5.3, swmansion React Native Reanimated)
- [CVE-2026-97723](https://cve.now/CVE-2026-97723.md): madpsy ka9q\_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. (CVSS 5.4, madpsy ka9q\_ubersdr)
- [CVE-2026-97649](https://cve.now/CVE-2026-97649.md): ningzichun student-management-system example\_lite.sql default credentials (CVSS 5.1, ningzichun student-management-system)
- [CVE-2026-95811](https://cve.now/CVE-2026-95811.md): Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it (CVSS 6.5, Lemonldap-NG-Handler)
- [CVE-2026-97648](https://cve.now/CVE-2026-97648.md): ningzichun student-management-system cross-site request forgery (CVSS 5.3, ningzichun student-management-system)
- [CVE-2026-97647](https://cve.now/CVE-2026-97647.md): ningzichun student-management-system editLog.php authorization (CVSS 6.9, ningzichun student-management-system)
- [CVE-2026-92289](https://cve.now/CVE-2026-92289.md): Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret (CVSS 9.1, Lemonldap-NG-Portal)
- [CVE-2026-97646](https://cve.now/CVE-2026-97646.md): ningzichun student-management-system getStudent.php authorization (CVSS 6.9, ningzichun student-management-system)
- [CVE-2026-92288](https://cve.now/CVE-2026-92288.md): Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party (CVSS 9.1, Lemonldap-NG-Portal)
- [CVE-2026-53493](https://cve.now/CVE-2026-53493.md): Containerd has image-pull DoS via crafted OCI index graph amplification (CVSS 6.9, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-85417](https://cve.now/CVE-2026-85417.md): Incomplete property masking in the SANnav logging subsystem (CVSS 6.4, Brocade SANnav)
- [CVE-2025-51457](https://cve.now/CVE-2025-51457.md): D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpo (CVSS 8.8)
- [CVE-2026-51772](https://cve.now/CVE-2026-51772.md): A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. (CVSS 6.5)
- [CVE-2026-51773](https://cve.now/CVE-2026-51773.md): An issue in the VMware datastore driver of OpenStack glance\_store. (CVSS 8.1)
- [CVE-2026-52622](https://cve.now/CVE-2026-52622.md): An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows (CVSS 7.5)
- [CVE-2026-78902](https://cve.now/CVE-2026-78902.md): Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG packa (CVSS 6.1)
- [CVE-2026-79153](https://cve.now/CVE-2026-79153.md): Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that al (CVSS 7.8)
- [CVE-2026-88389](https://cve.now/CVE-2026-88389.md): Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. (CVSS 6.2)
- [CVE-2026-88420](https://cve.now/CVE-2026-88420.md): A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authen (CVSS 5.4)
- [CVE-2026-88421](https://cve.now/CVE-2026-88421.md): Incorrect access control in the BlogPage.get\_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vie (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.