# CVEs published 2026-09-26

244 CVEs were published on September 26, 2026: 16 critical, 133 high. Days are UTC.

- [CVE-2026-100739](https://cve.now/CVE-2026-100739.md): mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-94408](https://cve.now/CVE-2026-94408.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 4.9, Elasticsearch)
- [CVE-2026-94397](https://cve.now/CVE-2026-94397.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5, Elasticsearch)
- [CVE-2026-94396](https://cve.now/CVE-2026-94396.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5, Elasticsearch)
- [CVE-2026-94400](https://cve.now/CVE-2026-94400.md): Uncontrolled Resource Consumption in Kibana Leading to denial of service (CVSS 6.5, Elastic Kibana · elk +1)
- [CVE-2026-94399](https://cve.now/CVE-2026-94399.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5, Elasticsearch)
- [CVE-2026-94398](https://cve.now/CVE-2026-94398.md): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5, Elasticsearch)
- [CVE-2026-82300](https://cve.now/CVE-2026-82300.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5, Elasticsearch)
- [CVE-2026-82294](https://cve.now/CVE-2026-82294.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5, Elasticsearch)
- [CVE-2026-78582](https://cve.now/CVE-2026-78582.md): Missing Authorization in Kibana Leading to Unauthorized Deletion of Data (CVSS 6.5, Elastic Kibana)
- [CVE-2026-72662](https://cve.now/CVE-2026-72662.md): Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data (CVSS 6.3, Elastic Kibana)
- [CVE-2026-72668](https://cve.now/CVE-2026-72668.md): Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation (CVSS 7.3, Elastic Kibana)
- [CVE-2026-82901](https://cve.now/CVE-2026-82901.md): Ultra Addons for Contact Form 7 \<= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field (CVSS 9.8, themefic Ultra Addons for Contact Form)
- [CVE-2026-77203](https://cve.now/CVE-2026-77203.md): Groups \<= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups\_join' Shortcode (CVSS 8.8, itthinx Groups – Memberships and Access Control)
- [CVE-2026-85984](https://cve.now/CVE-2026-85984.md): miniOrange OTP Login, Verification and SMS Notifications \<= 5.5.5 - Unauthenticated Authentication Bypass via 'mo\_wp\_login\_intent' Parameter (CVSS 9.8, cyberlord92 miniOrange OTP Login, Verification and SMS Noti…)
- [CVE-2026-97161](https://cve.now/CVE-2026-97161.md): Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 (CVSS 9.2, lomart.fr UP plugin for Joomla)
- [CVE-2026-97163](https://cve.now/CVE-2026-97163.md): Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 (CVSS 10.0, lomart.fr UP plugin for Joomla)
- [CVE-2026-97162](https://cve.now/CVE-2026-97162.md): Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 (CVSS 8.3, lomart.fr UP plugin for Joomla)
- [CVE-2026-97160](https://cve.now/CVE-2026-97160.md): Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 (CVSS 9.4, lomart.fr UP plugin for Joomla)
- [CVE-2026-94131](https://cve.now/CVE-2026-94131.md): Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension \< 11.1.0 (CVSS 8.3, acymailing.com AcyMailing extension for Joomla)
- [CVE-2026-94132](https://cve.now/CVE-2026-94132.md): Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension \< 11.1.0 (CVSS 9.5, acymailing.com AcyMailing Enterprise extension for Joomla)
- [CVE-2026-94130](https://cve.now/CVE-2026-94130.md): Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension \< 5.7.3 (CVSS 9.3, joomlaboat.com YouTube Gallery extension for Joomla)
- [CVE-2026-100626](https://cve.now/CVE-2026-100626.md): capgo through 12.128.2 IDOR via PUT /app icon endpoint (CVSS 5.3, Cap-go capgo.app)
- [CVE-2026-100720](https://cve.now/CVE-2026-100720.md): Froxlor before 2.3.12 Stored XSS via SSL certificate issuer (CVSS 9.3, froxlor)
- [CVE-2026-100719](https://cve.now/CVE-2026-100719.md): Froxlor before 2.3.12 Credential Disclosure via DirProtections API (CVSS 7.1, froxlor)
- [CVE-2026-100718](https://cve.now/CVE-2026-100718.md): Froxlor before 2.3.12 Authentication Bypass via EmailSender.add (CVSS 7.1, froxlor)
- [CVE-2026-100717](https://cve.now/CVE-2026-100717.md): froxlor before 2.3.12 CRLF Injection via validateUrl userinfo (CVSS 8.5, froxlor)
- [CVE-2026-100716](https://cve.now/CVE-2026-100716.md): Froxlor before 2.3.12 Privilege Escalation via Symlink (CVSS 9.4, froxlor)
- [CVE-2026-100715](https://cve.now/CVE-2026-100715.md): Froxlor before 2.3.12 Arbitrary File Deletion via Symlink (CVSS 8.5, froxlor)
- [CVE-2026-100714](https://cve.now/CVE-2026-100714.md): Froxlor before 2.3.12 Command Injection via letsencryptchallengepath (CVSS 9.4, froxlor)
- [CVE-2026-100713](https://cve.now/CVE-2026-100713.md): Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync (CVSS 7.1, froxlor)
- [CVE-2026-100712](https://cve.now/CVE-2026-100712.md): froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF (CVSS 7.1, froxlor)
- [CVE-2026-100711](https://cve.now/CVE-2026-100711.md): froxlor before 2.3.12 Authentication Bypass via Session Persistence (CVSS 8.7, froxlor)
- [CVE-2026-100710](https://cve.now/CVE-2026-100710.md): Froxlor before 2.3.12 DKIM Private Key Disclosure via API (CVSS 6.9, froxlor)
- [CVE-2026-100709](https://cve.now/CVE-2026-100709.md): Froxlor before 2.3.11 2FA Bypass via Namespace Confusion (CVSS 7.7, froxlor)
- [CVE-2026-100708](https://cve.now/CVE-2026-100708.md): Froxlor before 2.3.13 Private Key Disclosure via Certificates API (CVSS 7.1, froxlor)
- [CVE-2026-100707](https://cve.now/CVE-2026-100707.md): Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path (CVSS 8.3, kyverno)
- [CVE-2026-100706](https://cve.now/CVE-2026-100706.md): kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath (CVSS 9.4, kyverno)
- [CVE-2026-100705](https://cve.now/CVE-2026-100705.md): Kyverno before 1.19.1 SSRF via legacy apiCall service executor (CVSS 8.3, kyverno)
- [CVE-2026-100704](https://cve.now/CVE-2026-100704.md): Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass (CVSS 8.3, kyverno)
- [CVE-2026-100703](https://cve.now/CVE-2026-100703.md): Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib (CVSS 8.3, kyverno)
- [CVE-2026-100702](https://cve.now/CVE-2026-100702.md): Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays (CVSS 8.2, nodemailer)
- [CVE-2026-100701](https://cve.now/CVE-2026-100701.md): Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion (CVSS 6.0, nodemailer)
- [CVE-2026-100700](https://cve.now/CVE-2026-100700.md): nodemailer before 10.0.6 Denial of Service via addressparser (CVSS 8.7, nodemailer)
- [CVE-2026-100699](https://cve.now/CVE-2026-100699.md): Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment (CVSS 6.9, nodemailer)
- [CVE-2026-100698](https://cve.now/CVE-2026-100698.md): Adminer before 6.0.2 Privileged-Port SSRF via host\_port Regex (CVSS 6.9, vrana adminer)
- [CVE-2026-100697](https://cve.now/CVE-2026-100697.md): Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver (CVSS 5.3, vrana adminer)
- [CVE-2026-100696](https://cve.now/CVE-2026-100696.md): Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver (CVSS 6.9, vrana adminer)
- [CVE-2026-100695](https://cve.now/CVE-2026-100695.md): Adminer before 6.0.2 XSS via CONNECTION\_ID escalating to RCE (CVSS 5.3, vrana adminer)
- [CVE-2026-100694](https://cve.now/CVE-2026-100694.md): Hugo before 0.166.0 Cross-Site Scripting via text/org (CVSS 5.1, gohugoio hugo)
- [CVE-2026-100693](https://cve.now/CVE-2026-100693.md): Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass (CVSS 8.6, gohugoio hugo)
- [CVE-2026-100692](https://cve.now/CVE-2026-100692.md): Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots (CVSS 8.7, gohugoio hugo)
- [CVE-2026-100691](https://cve.now/CVE-2026-100691.md): Hugo before 0.166.0 Stored XSS via lineAnchors code block option (CVSS 5.1, gohugoio hugo)
- [CVE-2026-100690](https://cve.now/CVE-2026-100690.md): Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks (CVSS 8.7, gohugoio hugo)
- [CVE-2026-100689](https://cve.now/CVE-2026-100689.md): GitPython before 3.1.62 Path Traversal via gitmodules path (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-100688](https://cve.now/CVE-2026-100688.md): Budibase server before 3.45.0 Cross-Tenant Information Disclosure (CVSS 7.1, budibase server)
- [CVE-2026-100687](https://cve.now/CVE-2026-100687.md): Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast (CVSS 7.0, budibase server)
- [CVE-2026-100686](https://cve.now/CVE-2026-100686.md): Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps (CVSS 8.6, budibase server)
- [CVE-2026-100685](https://cve.now/CVE-2026-100685.md): Budibase before 3.45.0 Information Disclosure via Chat Links (CVSS 8.3, budibase server)
- [CVE-2026-100684](https://cve.now/CVE-2026-100684.md): Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC (CVSS 9.2, budibase server)
- [CVE-2026-100683](https://cve.now/CVE-2026-100683.md): Budibase before 3.45.0 SQL Injection via column-rename DDL (CVSS 8.9, budibase server)
- [CVE-2026-100682](https://cve.now/CVE-2026-100682.md): Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink (CVSS 8.7, budibase server)
- [CVE-2026-100681](https://cve.now/CVE-2026-100681.md): Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook (CVSS 6.3, budibase server)
- [CVE-2026-100680](https://cve.now/CVE-2026-100680.md): Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import (CVSS 8.6, budibase server)
- [CVE-2026-100679](https://cve.now/CVE-2026-100679.md): stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket (CVSS 7.1, stoatchat)
- [CVE-2026-100678](https://cve.now/CVE-2026-100678.md): stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting (CVSS 8.3, stoatchat)
- [CVE-2026-100677](https://cve.now/CVE-2026-100677.md): stoatchat before 0.15.5 Account Enumeration via Error Location (CVSS 6.9, stoatchat)
- [CVE-2026-100676](https://cve.now/CVE-2026-100676.md): stoatchat before 0.15.5 Local Filesystem Read via SVG (CVSS 8.8, stoatchat)
- [CVE-2026-100675](https://cve.now/CVE-2026-100675.md): stoatchat before 0.15.5 Denial of Service via mass mentions (CVSS 7.1, stoatchat)
- [CVE-2026-100674](https://cve.now/CVE-2026-100674.md): stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization (CVSS 5.3, stoatchat)
- [CVE-2026-100673](https://cve.now/CVE-2026-100673.md): Grav Data Manager before 1.4.5 Stored XSS via item-detail view (CVSS 8.4, getgrav grav-plugin-datamanager)
- [CVE-2026-100672](https://cve.now/CVE-2026-100672.md): grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure (CVSS 8.7, getgrav grav-plugin-comments)
- [CVE-2026-100671](https://cve.now/CVE-2026-100671.md): Grav before 2.0.25 Session Cookie Theft via Twig Sandbox (CVSS 8.6, getgrav grav)
- [CVE-2026-100670](https://cve.now/CVE-2026-100670.md): Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass (CVSS 8.7, getgrav grav)
- [CVE-2026-100669](https://cve.now/CVE-2026-100669.md): Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass (CVSS 8.7, getgrav grav)
- [CVE-2026-100668](https://cve.now/CVE-2026-100668.md): Grav before 2.0.25 Sandbox Escape via array Filter (CVSS 7.1, getgrav grav)
- [CVE-2026-100667](https://cve.now/CVE-2026-100667.md): grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass (CVSS 6.9, getgrav grav)
- [CVE-2026-100666](https://cve.now/CVE-2026-100666.md): Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec (CVSS 6.9, netty)
- [CVE-2026-100665](https://cve.now/CVE-2026-100665.md): Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass (CVSS 8.7, netty)
- [CVE-2026-100664](https://cve.now/CVE-2026-100664.md): Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion (CVSS 8.7, netty)
- [CVE-2026-100663](https://cve.now/CVE-2026-100663.md): Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 (CVSS 8.7, netty)
- [CVE-2026-100662](https://cve.now/CVE-2026-100662.md): Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS (CVSS 8.7, netty)
- [CVE-2026-100661](https://cve.now/CVE-2026-100661.md): Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation (CVSS 8.7, netty)
- [CVE-2026-100660](https://cve.now/CVE-2026-100660.md): Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention (CVSS 8.7, netty)
- [CVE-2026-100659](https://cve.now/CVE-2026-100659.md): Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass (CVSS 6.9, netty)
- [CVE-2026-100654](https://cve.now/CVE-2026-100654.md): vLLM before 0.29.0 Denial of Service via out-of-range stop\_token\_ids (CVSS 7.1, vllm-project vllm)
- [CVE-2026-100653](https://cve.now/CVE-2026-100653.md): vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation (CVSS 8.3, vllm-project vllm · vllm)
- [CVE-2026-100652](https://cve.now/CVE-2026-100652.md): vLLM 0.22.0 through 0.23.0 Denial of Service via stop\_token\_ids (CVSS 8.2, vllm-project vllm · vllm)
- [CVE-2026-100651](https://cve.now/CVE-2026-100651.md): vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass (CVSS 7.1, vllm-project vllm)
- [CVE-2026-100650](https://cve.now/CVE-2026-100650.md): vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization (CVSS 7.1, vllm-project vllm · vllm)
- [CVE-2026-100649](https://cve.now/CVE-2026-100649.md): vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass (CVSS 6.3, vllm-project vllm)
- [CVE-2026-100648](https://cve.now/CVE-2026-100648.md): vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding (CVSS 6.9, vllm-project vllm)
- [CVE-2026-100647](https://cve.now/CVE-2026-100647.md): vLLM before 0.29.0 CPU Exhaustion via unbounded cache\_salt (CVSS 6.9, vllm-project vllm)
- [CVE-2026-100646](https://cve.now/CVE-2026-100646.md): SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-100645](https://cve.now/CVE-2026-100645.md): SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-100644](https://cve.now/CVE-2026-100644.md): SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-100643](https://cve.now/CVE-2026-100643.md): SiYuan before v3.8.4 Stored XSS via Attribute View textarea (CVSS 8.5, siyuan-note siyuan)
- [CVE-2026-100642](https://cve.now/CVE-2026-100642.md): SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth (CVSS 7.2, siyuan-note siyuan)
- [CVE-2026-100641](https://cve.now/CVE-2026-100641.md): SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-100640](https://cve.now/CVE-2026-100640.md): SiYuan before v3.8.4 Clipboard Data Disclosure via IPC (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-100639](https://cve.now/CVE-2026-100639.md): SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-100638](https://cve.now/CVE-2026-100638.md): SiYuan before v3.8.4 Path Traversal via setNotebookIcon (CVSS 8.3, siyuan-note siyuan)
- [CVE-2026-100637](https://cve.now/CVE-2026-100637.md): SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID (CVSS 8.3, siyuan-note siyuan)
- [CVE-2026-100636](https://cve.now/CVE-2026-100636.md): SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder (CVSS 8.3, siyuan-note siyuan)
- [CVE-2026-100635](https://cve.now/CVE-2026-100635.md): SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie (CVSS 8.2, siyuan-note siyuan)
- [CVE-2026-100634](https://cve.now/CVE-2026-100634.md): SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows (CVSS 5.3, siyuan-note siyuan)
- [CVE-2026-100633](https://cve.now/CVE-2026-100633.md): SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations (CVSS 8.5, siyuan-note siyuan)
- [CVE-2026-100632](https://cve.now/CVE-2026-100632.md): Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery (CVSS 7.1, parse-community parse-server · parse)
- [CVE-2026-100631](https://cve.now/CVE-2026-100631.md): Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection (CVSS 8.7, parse-community parse-server · parse)
- [CVE-2026-100630](https://cve.now/CVE-2026-100630.md): AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field (CVSS 5.1, WWBN AVideo)
- [CVE-2026-100629](https://cve.now/CVE-2026-100629.md): Capgo backend before 12.127.5 Privilege Escalation via role\_bindings PATCH (CVSS 7.0, Cap-go capgo.app)
- [CVE-2026-100628](https://cve.now/CVE-2026-100628.md): capgo.app before 12.128.12 Authentication Bypass via apikey (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100627](https://cve.now/CVE-2026-100627.md): Capgo bundle promotion API channel RBAC deny override bypass (CVSS 7.2, Cap-go capgo.app)
- [CVE-2026-100625](https://cve.now/CVE-2026-100625.md): Capgo Build Upload Proxy Authorization Bypass via TUS Resource (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100624](https://cve.now/CVE-2026-100624.md): Capgo.app before 12.264.5 Upload Expiry Bypass via build upload (CVSS 5.3, Cap-go capgo.app)
- [CVE-2026-100623](https://cve.now/CVE-2026-100623.md): Capgo Authentication Bypass via Direct PostgREST org\_users Table Write (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100622](https://cve.now/CVE-2026-100622.md): capgo.app through 12.129.0 Cache Restoration of Deleted Bundles (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100621](https://cve.now/CVE-2026-100621.md): capgo.app Content-Lock Bypass via r2-direct Bundle Mutation (CVSS 5.3, Cap-go capgo.app)
- [CVE-2026-100620](https://cve.now/CVE-2026-100620.md): Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account (CVSS 5.1, Cap-go @capgo/cli)
- [CVE-2026-100619](https://cve.now/CVE-2026-100619.md): Capgo OTA Manifest Poisoning via app\_versions.manifest Bypass (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100618](https://cve.now/CVE-2026-100618.md): Capgo App Icon Update Privilege Escalation via Service-Role Worker (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100617](https://cve.now/CVE-2026-100617.md): Cap-go capgo.app Authorization Bypass via channel\_permission\_overrides (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100616](https://cve.now/CVE-2026-100616.md): capgo.app Authentication Bypass via PostgREST customer\_id Mutation (CVSS 7.0, Cap-go capgo.app)
- [CVE-2026-100615](https://cve.now/CVE-2026-100615.md): Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100614](https://cve.now/CVE-2026-100614.md): Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-100613](https://cve.now/CVE-2026-100613.md): capgo.app Authorization Bypass via Stale Channel Permission Overrides (CVSS 6.0, Cap-go capgo.app)
- [CVE-2026-100612](https://cve.now/CVE-2026-100612.md): Capgo SSO Provider ID Authentication Bypass via Incomplete Migration (CVSS 8.6, Cap-go capgo.app)
- [CVE-2026-100611](https://cve.now/CVE-2026-100611.md): Capgo apikey\_manager Role Privilege Escalation via Incomplete Role Deny-list (CVSS 7.1, Cap-go capgo.app)
- [CVE-2026-100610](https://cve.now/CVE-2026-100610.md): Flowise through 3.1.4 Missing Authorization via upsert-history (CVSS 7.7, FlowiseAI Flowise)
- [CVE-2026-100609](https://cve.now/CVE-2026-100609.md): Flowise through 3.1.4 Insecure Direct Object Reference via Credential (CVSS 7.6, FlowiseAI Flowise)
- [CVE-2026-100608](https://cve.now/CVE-2026-100608.md): Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard (CVSS 8.7, FlowiseAI Flowise)
- [CVE-2026-100607](https://cve.now/CVE-2026-100607.md): Flowise through 3.1.4 Authentication Bypass via Email-Only SSO (CVSS 9.2, FlowiseAI Flowise)
- [CVE-2026-100606](https://cve.now/CVE-2026-100606.md): Flowise through 3.1.4 Authentication Bypass via SSO Email Match (CVSS 9.2, FlowiseAI Flowise)
- [CVE-2026-100605](https://cve.now/CVE-2026-100605.md): Flowise through 3.1.4 Missing Authorization via Chat Message Routes (CVSS 7.5, FlowiseAI Flowise)
- [CVE-2026-100604](https://cve.now/CVE-2026-100604.md): ClawHub Authentication Bypass via Former Publisher Skill Control (CVSS 5.3, openclaw clawhub)
- [CVE-2026-100603](https://cve.now/CVE-2026-100603.md): ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports (CVSS 8.7, openclaw clawhub)
- [CVE-2026-100602](https://cve.now/CVE-2026-100602.md): ClawHub Changelog Preview Information Disclosure via Authorization Bypass (CVSS 7.1, openclaw clawhub)
- [CVE-2026-100601](https://cve.now/CVE-2026-100601.md): ClawHub SSRF via Unchecked DNS Resolution in Profile Image (CVSS 6.9, openclaw clawhub)
- [CVE-2026-100600](https://cve.now/CVE-2026-100600.md): ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API (CVSS 6.9, openclaw clawhub)
- [CVE-2026-100315](https://cve.now/CVE-2026-100315.md): mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-100314](https://cve.now/CVE-2026-100314.md): mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-100313](https://cve.now/CVE-2026-100313.md): mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-100312](https://cve.now/CVE-2026-100312.md): mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-98163](https://cve.now/CVE-2026-98163.md): cgroup: Avoid iteration of dying tasks with zero refcount (CVSS 7.8, Linux)
- [CVE-2026-100311](https://cve.now/CVE-2026-100311.md): mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting (CVSS 5.1, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-18143](https://cve.now/CVE-2026-18143.md): Request a Quote for WooCommerce \<= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler (CVSS 9.8, Addify Request a Quote for WooCommerce)
- [CVE-2026-96533](https://cve.now/CVE-2026-96533.md): Testimonials Widget \<= 4.0.4 - Unauthenticated SSRF via Featured Image URL (CVSS 5.8, Testimonials Widget)
- [CVE-2026-96532](https://cve.now/CVE-2026-96532.md): Testimonials Widget \<= 4.0.4 - Unauthenticated Arbitrary Post Update (CVSS 7.5, Testimonials Widget)
- [CVE-2026-96531](https://cve.now/CVE-2026-96531.md): Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block (CVSS 6.8, Optimole)
- [CVE-2026-96526](https://cve.now/CVE-2026-96526.md): MCP Server for WordPress \< 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route (CVSS 2.7, MCP Server for WordPress)
- [CVE-2026-96525](https://cve.now/CVE-2026-96525.md): MCP Server for WordPress \< 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check (CVSS 2.7, MCP Server for WordPress)
- [CVE-2026-96524](https://cve.now/CVE-2026-96524.md): MCP Server for WordPress \< 1.8.2 - Administrator Account Creation via CSRF (CVSS 8.8, MCP Server for WordPress)
- [CVE-2026-92411](https://cve.now/CVE-2026-92411.md): WP Delicious \< 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name (CVSS 6.8, WP Delicious)
- [CVE-2026-85081](https://cve.now/CVE-2026-85081.md): Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass (CVSS 7.5, File Manager · FileOrganizer)
- [CVE-2026-84097](https://cve.now/CVE-2026-84097.md): WP Review Slider Pro \< 12.7.12 - Subscriber+ SQLi via Stored Template Filter (CVSS 6.5, wp-review-slider-pro)
- [CVE-2026-84096](https://cve.now/CVE-2026-84096.md): WP Review Slider Pro \< 12.7.12 - Subscriber+ Stored XSS via Review Form Fields (CVSS 8.0, wp-review-slider-pro)
- [CVE-2026-84095](https://cve.now/CVE-2026-84095.md): WP Review Slider Pro \< 12.7.12 - Subscriber+ Stored XSS via Review Import (CVSS 8.0, wp-review-slider-pro)
- [CVE-2026-19708](https://cve.now/CVE-2026-19708.md): File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure (CVSS 5.9, File Manager)
- [CVE-2026-16591](https://cve.now/CVE-2026-16591.md): WP Directory Kit \< 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields (CVSS 7.2, WP Directory Kit)
- [CVE-2026-11871](https://cve.now/CVE-2026-11871.md): Team Showcase Supreme \< 9.3 - Unauthenticated Sensitive Data Disclosure via wpm\_6310\_team\_member\_details (CVSS 5.3, Team Members)
- [CVE-2026-89237](https://cve.now/CVE-2026-89237.md): Bluff Post \<= 1.1.1 - Unauthenticated SQLi via 'table\_name' and 'column\_name' Parameters (CVSS 6.8, Bluff Post)
- [CVE-2026-15273](https://cve.now/CVE-2026-15273.md): Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST\_URI (CVSS 6.4, Automatic.css)
- [CVE-2026-100599](https://cve.now/CVE-2026-100599.md): OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome (CVSS 8.7, OpenClaw)
- [CVE-2026-100598](https://cve.now/CVE-2026-100598.md): OpenClaw before 2026.7.1 Approval Binding Logic Error (CVSS 7.5, OpenClaw)
- [CVE-2026-100597](https://cve.now/CVE-2026-100597.md): OpenClaw before 2026.7.1 Path Traversal via Filesystem Race (CVSS 8.8, OpenClaw)
- [CVE-2026-100596](https://cve.now/CVE-2026-100596.md): OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration (CVSS 8.7, OpenClaw)
- [CVE-2026-100595](https://cve.now/CVE-2026-100595.md): OpenClaw before 2026.7.1 Authorization Bypass via diagnostics (CVSS 7.1, OpenClaw)
- [CVE-2026-100594](https://cve.now/CVE-2026-100594.md): OpenClaw before 2026.7.1 Authorization Bypass via trajectory export (CVSS 7.1, OpenClaw)
- [CVE-2026-100593](https://cve.now/CVE-2026-100593.md): OpenClaw before 2026.7.1 Authentication Bypass via activation (CVSS 5.3, OpenClaw)
- [CVE-2026-100592](https://cve.now/CVE-2026-100592.md): OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming (CVSS 5.3, OpenClaw)
- [CVE-2026-100591](https://cve.now/CVE-2026-100591.md): OpenClaw before 2026.7.1 Authentication Bypass via Active Memory (CVSS 5.3, OpenClaw)
- [CVE-2026-100590](https://cve.now/CVE-2026-100590.md): OpenClaw before 2026.7.1 Authorization Bypass via voice set (CVSS 5.3, OpenClaw)
- [CVE-2026-100589](https://cve.now/CVE-2026-100589.md): OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node (CVSS 8.7, OpenClaw)
- [CVE-2026-100588](https://cve.now/CVE-2026-100588.md): OpenClaw before 2026.7.1 Authentication Bypass via node.invoke (CVSS 8.7, OpenClaw)
- [CVE-2026-100587](https://cve.now/CVE-2026-100587.md): OpenClaw before 2026.7.1 Authorization Bypass via Codex Install (CVSS 8.7, OpenClaw)
- [CVE-2026-100586](https://cve.now/CVE-2026-100586.md): OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind (CVSS 8.7, OpenClaw)
- [CVE-2026-100585](https://cve.now/CVE-2026-100585.md): OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel (CVSS 8.6, OpenClaw)
- [CVE-2026-100584](https://cve.now/CVE-2026-100584.md): OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows (CVSS 5.4, OpenClaw)
- [CVE-2026-100583](https://cve.now/CVE-2026-100583.md): OpenClaw Discord before 2026.7.1 Authorization Bypass (CVSS 5.3, openclaw discord)
- [CVE-2026-100582](https://cve.now/CVE-2026-100582.md): OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass (CVSS 7.1, openclaw msteams · openclaw feishu +6)
- [CVE-2026-100581](https://cve.now/CVE-2026-100581.md): OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension (CVSS 6.8, OpenClaw)
- [CVE-2026-100580](https://cve.now/CVE-2026-100580.md): OpenClaw before 2026.7.1 Remote Code Execution via cron tool (CVSS 8.7, OpenClaw)
- [CVE-2026-100579](https://cve.now/CVE-2026-100579.md): OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester (CVSS 7.2, OpenClaw)
- [CVE-2026-100578](https://cve.now/CVE-2026-100578.md): OpenClaw before 2026.7.1 Authorization Bypass via chat.send (CVSS 7.2, OpenClaw)
- [CVE-2026-100577](https://cve.now/CVE-2026-100577.md): OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset (CVSS 5.3, OpenClaw)
- [CVE-2026-100576](https://cve.now/CVE-2026-100576.md): OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates (CVSS 5.3, OpenClaw)
- [CVE-2026-100575](https://cve.now/CVE-2026-100575.md): OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM (CVSS 8.7, openclaw slack)
- [CVE-2026-100574](https://cve.now/CVE-2026-100574.md): OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS (CVSS 8.2, OpenClaw)
- [CVE-2026-100573](https://cve.now/CVE-2026-100573.md): OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback (CVSS 4.8, OpenClaw)
- [CVE-2026-100572](https://cve.now/CVE-2026-100572.md): OpenClaw before 2026.8.1 Denial of Service via Rate Limit (CVSS 6.9, OpenClaw)
- [CVE-2026-100571](https://cve.now/CVE-2026-100571.md): OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass (CVSS 6.9, OpenClaw)
- [CVE-2026-100570](https://cve.now/CVE-2026-100570.md): OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK\_PYTHON\_ARGS (CVSS 8.5, OpenClaw)
- [CVE-2026-100569](https://cve.now/CVE-2026-100569.md): OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override (CVSS 6.8, OpenClaw)
- [CVE-2026-100568](https://cve.now/CVE-2026-100568.md): OpenClaw before 2026.8.1 Unauthorized Command Job Access (CVSS 8.7, OpenClaw)
- [CVE-2026-100567](https://cve.now/CVE-2026-100567.md): OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname (CVSS 8.9, OpenClaw)
- [CVE-2026-100566](https://cve.now/CVE-2026-100566.md): OpenClaw LINE before 2026.8.1 Access Control Inheritance (CVSS 6.9, openclaw line)
- [CVE-2026-100564](https://cve.now/CVE-2026-100564.md): OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export (CVSS 5.3, OpenClaw)
- [CVE-2026-100563](https://cve.now/CVE-2026-100563.md): OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels (CVSS 5.3, OpenClaw)
- [CVE-2026-100562](https://cve.now/CVE-2026-100562.md): OpenClaw before 2026.8.1 Authorization Bypass via sessions.create (CVSS 5.3, OpenClaw)
- [CVE-2026-100561](https://cve.now/CVE-2026-100561.md): OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper (CVSS 8.6, OpenClaw)
- [CVE-2026-100560](https://cve.now/CVE-2026-100560.md): OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass (CVSS 7.7, OpenClaw)
- [CVE-2026-100559](https://cve.now/CVE-2026-100559.md): OpenClaw before 2026.8.1 Command Injection via Escaped Newlines (CVSS 8.6, OpenClaw)
- [CVE-2026-100558](https://cve.now/CVE-2026-100558.md): OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade (CVSS 8.7, OpenClaw)
- [CVE-2026-100557](https://cve.now/CVE-2026-100557.md): OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch (CVSS 8.7, OpenClaw)
- [CVE-2026-100556](https://cve.now/CVE-2026-100556.md): OpenClaw before 2026.8.1 Authentication Bypass via Session Reset (CVSS 5.3, OpenClaw)
- [CVE-2026-100555](https://cve.now/CVE-2026-100555.md): OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery (CVSS 7.1, OpenClaw)
- [CVE-2026-100554](https://cve.now/CVE-2026-100554.md): OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass (CVSS 2.3, OpenClaw)
- [CVE-2026-100553](https://cve.now/CVE-2026-100553.md): OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin (CVSS 5.3, OpenClaw)
- [CVE-2026-100552](https://cve.now/CVE-2026-100552.md): OpenClaw before 2026.8.1 Policy Bypass via Native Tools (CVSS 8.7, OpenClaw)
- [CVE-2026-100551](https://cve.now/CVE-2026-100551.md): OpenClaw iOS Control UI TLS Pin Enforcement Bypass (CVSS 9.0, OpenClaw)
- [CVE-2026-100550](https://cve.now/CVE-2026-100550.md): OpenClaw before 2026.8.1 Authentication Bypass via Access Group (CVSS 5.3, OpenClaw)
- [CVE-2026-100549](https://cve.now/CVE-2026-100549.md): OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames (CVSS 5.3, OpenClaw)
- [CVE-2026-100548](https://cve.now/CVE-2026-100548.md): OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback (CVSS 6.0, OpenClaw)
- [CVE-2026-100547](https://cve.now/CVE-2026-100547.md): OpenClaw before 2026.8.1 Authentication Bypass via File URL (CVSS 6.8, OpenClaw)
- [CVE-2026-100546](https://cve.now/CVE-2026-100546.md): OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript (CVSS 6.1, OpenClaw)
- [CVE-2026-100545](https://cve.now/CVE-2026-100545.md): OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation (CVSS 6.0, OpenClaw)
- [CVE-2026-100544](https://cve.now/CVE-2026-100544.md): openclaw voice-call before 2026.8.1 Authorization Bypass (CVSS 8.7, openclaw voice-call)
- [CVE-2026-100543](https://cve.now/CVE-2026-100543.md): OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash (CVSS 7.7, OpenClaw)
- [CVE-2026-100542](https://cve.now/CVE-2026-100542.md): OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2 (CVSS 2.3, OpenClaw)
- [CVE-2026-100541](https://cve.now/CVE-2026-100541.md): OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding (CVSS 7.7, openclaw matrix)
- [CVE-2026-100540](https://cve.now/CVE-2026-100540.md): OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account (CVSS 7.6, openclaw feishu)
- [CVE-2026-100539](https://cve.now/CVE-2026-100539.md): OpenClaw before 2026.8.1 Memory Access Control Bypass (CVSS 2.1, OpenClaw)
- [CVE-2026-100538](https://cve.now/CVE-2026-100538.md): OpenClaw before 2026.8.1 Local File Read via Outbound Attachments (CVSS 7.1, OpenClaw)
- [CVE-2026-100537](https://cve.now/CVE-2026-100537.md): OpenClaw before 2026.8.1 Authentication Bypass via Active Memory (CVSS 2.3, OpenClaw)
- [CVE-2026-100536](https://cve.now/CVE-2026-100536.md): OpenClaw before 2026.8.1 Path Traversal via Structured Attachments (CVSS 7.1, OpenClaw)
- [CVE-2026-100535](https://cve.now/CVE-2026-100535.md): OpenClaw before 2026.8.1 Privilege Escalation via Session Memory (CVSS 7.7, OpenClaw)
- [CVE-2026-100534](https://cve.now/CVE-2026-100534.md): OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass (CVSS 2.3, OpenClaw)
- [CVE-2026-100533](https://cve.now/CVE-2026-100533.md): OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback (CVSS 6.0, OpenClaw)
- [CVE-2026-100532](https://cve.now/CVE-2026-100532.md): openclaw WhatsApp before 2026.8.1 Authentication Bypass (CVSS 7.2, openclaw whatsapp)
- [CVE-2026-100531](https://cve.now/CVE-2026-100531.md): openclaw Slack before 2026.8.1 Authorization Bypass (CVSS 7.1, openclaw slack)
- [CVE-2026-100530](https://cve.now/CVE-2026-100530.md): OpenClaw before 2026.8.1 Exec Approval Directory Binding (CVSS 8.5, OpenClaw)
- [CVE-2026-100529](https://cve.now/CVE-2026-100529.md): OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer (CVSS 7.4, OpenClaw)
- [CVE-2026-100528](https://cve.now/CVE-2026-100528.md): OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint (CVSS 5.9, OpenClaw)
- [CVE-2026-100527](https://cve.now/CVE-2026-100527.md): OpenClaw before 2026.8.2 Denial of Service via Browser Relay (CVSS 6.9, OpenClaw)
- [CVE-2026-100526](https://cve.now/CVE-2026-100526.md): Vulnerability in discord (CVSS 6.0, openclaw discord)
- [CVE-2026-100525](https://cve.now/CVE-2026-100525.md): OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass (CVSS 5.3, openclaw diagnostics-prometheus)
- [CVE-2026-100524](https://cve.now/CVE-2026-100524.md): Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager (CVSS 5.3, Cotonti)
- [CVE-2026-100523](https://cve.now/CVE-2026-100523.md): Cotonti through 1.0.0 Open Redirect via message.php redirect parameter (CVSS 5.1, Cotonti)
- [CVE-2026-100522](https://cve.now/CVE-2026-100522.md): Cotonti through 1.0.0 Reflected XSS via message.php lng parameter (CVSS 5.1, Cotonti)
- [CVE-2026-100521](https://cve.now/CVE-2026-100521.md): Cotonti through 1.0.0 Reflected XSS via search highlight parameter (CVSS 5.1, Cotonti)
- [CVE-2026-100520](https://cve.now/CVE-2026-100520.md): Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint (CVSS 8.7, crivion Laranode)
- [CVE-2026-100505](https://cve.now/CVE-2026-100505.md): Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager (CVSS 4.8, NationalSecurityAgency ghidra)
- [CVE-2026-100504](https://cve.now/CVE-2026-100504.md): Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 (CVSS 7.3, NationalSecurityAgency ghidra)
- [CVE-2026-100503](https://cve.now/CVE-2026-100503.md): Ghidra through 12.1.4 Heap Use-After-Free in Decompiler (CVSS 4.8, NationalSecurityAgency ghidra)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.