# CVEs published 2026-09-27

151 CVEs were published on September 27, 2026: 11 critical, 60 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-100889](https://cve.now/CVE-2026-100889.md): Trusted Domain Project OpenDKIM Decoder util.c dkim\_qp\_decode off-by-one (CVSS 6.9, Trusted Domain Project OpenDKIM)
- [CVE-2026-100888](https://cve.now/CVE-2026-100888.md): Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim\_canon\_selecthdrs out-of-bounds write (CVSS 6.9, Trusted Domain Project OpenDKIM)
- [CVE-2026-100887](https://cve.now/CVE-2026-100887.md): amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB\_query\_builder.php order\_by sql injection (CVSS 5.3, amirsanni Mini-Inventory-and-Sales-Management-System)
- [CVE-2026-100886](https://cve.now/CVE-2026-100886.md): Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication (CVSS 10.0, Seetong T8108 · Seetong T8108P +2)
- [CVE-2026-100885](https://cve.now/CVE-2026-100885.md): Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization (CVSS 6.9, Krayin laravel-crm)
- [CVE-2026-100884](https://cve.now/CVE-2026-100884.md): Krayin laravel-crm attachment-download Endpoint acl.php resource injection (CVSS 5.3, Krayin laravel-crm)
- [CVE-2026-100883](https://cve.now/CVE-2026-100883.md): Krayin laravel-crm acl.php access control (CVSS 5.3, Krayin laravel-crm)
- [CVE-2026-96284](https://cve.now/CVE-2026-96284.md): Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following (CVSS 2.5, Red Hat Enterprise Linux)
- [CVE-2026-100882](https://cve.now/CVE-2026-100882.md): Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting (CVSS 4.8, Krayin laravel-crm)
- [CVE-2026-96282](https://cve.now/CVE-2026-96282.md): Flatpak: flatpak: extension metadata path traversal file existence oracle (CVSS 3.1, Red Hat Enterprise Linux)
- [CVE-2026-96283](https://cve.now/CVE-2026-96283.md): Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull (CVSS 3.3, Red Hat Enterprise Linux)
- [CVE-2026-100881](https://cve.now/CVE-2026-100881.md): zhistaredu StarTraining application.yml cross site scripting (CVSS 2.1, zhistaredu StarTraining)
- [CVE-2026-96281](https://cve.now/CVE-2026-96281.md): Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2026-100880](https://cve.now/CVE-2026-100880.md): zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting (CVSS 5.1, zhistaredu StarTraining)
- [CVE-2026-101090](https://cve.now/CVE-2026-101090.md): Nezha through 2.2.3 Host Header Injection via OAuth2 redirect\_uri (CVSS 9.3, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-101089](https://cve.now/CVE-2026-101089.md): Nezha before 2.2.7 Information Disclosure via /api/v1/profile (CVSS 2.3, nezhahq nezha)
- [CVE-2026-101088](https://cve.now/CVE-2026-101088.md): Nezha before 2.3.1 Denial of Service via Concurrent Server Delete (CVSS 6.0, nezhahq nezha)
- [CVE-2026-101087](https://cve.now/CVE-2026-101087.md): Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 (CVSS 5.3, nezhahq nezha)
- [CVE-2026-101086](https://cve.now/CVE-2026-101086.md): Nezha Dashboard before 2.3.5 Task Type Validation Bypass (CVSS 7.1, nezhahq nezha)
- [CVE-2026-101085](https://cve.now/CVE-2026-101085.md): Nezha before 2.3.8 Denial of Service via Alert Rule (CVSS 7.1, nezhahq nezha)
- [CVE-2026-101084](https://cve.now/CVE-2026-101084.md): obot before v0.21.1 Authorization Bypass via /mcp-connect (CVSS 9.3, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-101065](https://cve.now/CVE-2026-101065.md): Obot Quickstart Docker Deployment Unauthenticated Admin Access (CVSS 9.3, obot-platform obot)
- [CVE-2026-101064](https://cve.now/CVE-2026-101064.md): Obot before v0.23.0 Server-Side Request Forgery via MCP (CVSS 8.3, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-101063](https://cve.now/CVE-2026-101063.md): Obot before v0.23.0 Authentication Bypass via Registry API (CVSS 6.9, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-101062](https://cve.now/CVE-2026-101062.md): Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration (CVSS 8.7, obot-platform obot · github.com/obot-platform/obot)
- [CVE-2026-100879](https://cve.now/CVE-2026-100879.md): zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization (CVSS 5.3, zhistaredu StarTraining)
- [CVE-2026-100878](https://cve.now/CVE-2026-100878.md): zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization (CVSS 5.3, zhistaredu StarTraining)
- [CVE-2026-96280](https://cve.now/CVE-2026-96280.md): Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-100877](https://cve.now/CVE-2026-100877.md): mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-96279](https://cve.now/CVE-2026-96279.md): Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-100876](https://cve.now/CVE-2026-100876.md): mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-100875](https://cve.now/CVE-2026-100875.md): mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-100874](https://cve.now/CVE-2026-100874.md): mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-100873](https://cve.now/CVE-2026-100873.md): mathurvishal CloudClassroom-PHP-Project cross-site request forgery (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-101061](https://cve.now/CVE-2026-101061.md): utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass (CVSS 2.3, universal-tool-calling-protocol python-utcp)
- [CVE-2026-101060](https://cve.now/CVE-2026-101060.md): python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects (CVSS 8.4, universal-tool-calling-protocol python-utcp)
- [CVE-2026-101059](https://cve.now/CVE-2026-101059.md): utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass (CVSS 7.1, universal-tool-calling-protocol python-utcp)
- [CVE-2026-101058](https://cve.now/CVE-2026-101058.md): python-utcp before 1.1.12 SSRF via Remote HTTP Manual (CVSS 7.1, universal-tool-calling-protocol python-utcp)
- [CVE-2026-101057](https://cve.now/CVE-2026-101057.md): utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL (CVSS 2.3, universal-tool-calling-protocol python-utcp)
- [CVE-2026-101056](https://cve.now/CVE-2026-101056.md): Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint (CVSS 6.9, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-101051](https://cve.now/CVE-2026-101051.md): Cloudreve before 4.16.1 Path Traversal via Remote Download (CVSS 2.3, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-101048](https://cve.now/CVE-2026-101048.md): Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope (CVSS 5.3, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-101047](https://cve.now/CVE-2026-101047.md): Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs (CVSS 6.9, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-101046](https://cve.now/CVE-2026-101046.md): Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints (CVSS 2.3, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-101045](https://cve.now/CVE-2026-101045.md): Fleet Homebrew Cask OS Command Injection via Metadata (CVSS 8.9, fleetdm fleet)
- [CVE-2026-101044](https://cve.now/CVE-2026-101044.md): pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias (CVSS 7.1, pnpm)
- [CVE-2026-101043](https://cve.now/CVE-2026-101043.md): pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings (CVSS 8.3, pnpm)
- [CVE-2026-88778](https://cve.now/CVE-2026-88778.md): TCP Initial Sequence Number (ISN) prediction (CVSS 8.8, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-88777](https://cve.now/CVE-2026-88777.md): Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (CVSS 8.8, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-88776](https://cve.now/CVE-2026-88776.md): Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (CVSS 8.8, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-101050](https://cve.now/CVE-2026-101050.md): Heym before 0.0.53 Authentication Bypass via Telegram Webhook (CVSS 8.3, heymrun heym)
- [CVE-2026-101049](https://cve.now/CVE-2026-101049.md): Heym before 0.0.53 Slack Webhook Signature Verification Bypass (CVSS 8.3, heymrun heym)
- [CVE-2026-101042](https://cve.now/CVE-2026-101042.md): Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity (CVSS 7.4, parse-community parse-server · parse)
- [CVE-2026-88775](https://cve.now/CVE-2026-88775.md): Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (CVSS 8.8, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-88773](https://cve.now/CVE-2026-88773.md): HTTP Request Smuggling (CVSS 9.3, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-88774](https://cve.now/CVE-2026-88774.md): Feature policy bypass due to improper HTTP URL based expression usage (CVSS 7.0, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-88772](https://cve.now/CVE-2026-88772.md): Memory overflow vulnerability leading to Remote Code Execution or Denial of Service (CVSS 9.5, KEV, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-88771](https://cve.now/CVE-2026-88771.md): A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands (CVSS 9.5, KEV, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-101041](https://cve.now/CVE-2026-101041.md): Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover (CVSS 6.3, vulnerability-lookup)
- [CVE-2026-101033](https://cve.now/CVE-2026-101033.md): KitchenOwl through 0.7.10 IDOR via unchecked category ID (CVSS 5.3, TomBursch kitchenowl)
- [CVE-2026-101032](https://cve.now/CVE-2026-101032.md): navi through 2.24.0 OS Command Injection via Cheatsheet Variables (CVSS 7.3, denisidoro navi)
- [CVE-2026-100872](https://cve.now/CVE-2026-100872.md): Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite (CVSS 8.7, Sylius)
- [CVE-2026-100871](https://cve.now/CVE-2026-100871.md): Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication (CVSS 8.7, Sylius)
- [CVE-2026-100870](https://cve.now/CVE-2026-100870.md): Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header (CVSS 8.7, Sylius)
- [CVE-2026-100869](https://cve.now/CVE-2026-100869.md): Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API (CVSS 8.2, Sylius)
- [CVE-2026-100868](https://cve.now/CVE-2026-100868.md): Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge (CVSS 5.3, penpot · @penpot/mcp)
- [CVE-2026-100867](https://cve.now/CVE-2026-100867.md): spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection (CVSS 4.8, spaceship-prompt)
- [CVE-2026-100866](https://cve.now/CVE-2026-100866.md): onefetch through 2.28.1 Terminal Escape Sequence Injection (CVSS 4.8, o2sh onefetch)
- [CVE-2026-100748](https://cve.now/CVE-2026-100748.md): Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension \< 6.5.0 (CVSS 6.9, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-97164](https://cve.now/CVE-2026-97164.md): Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension \< 6.5.0 (CVSS 7.0, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-100747](https://cve.now/CVE-2026-100747.md): Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension \< 6.5.0 (CVSS 5.1, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-100749](https://cve.now/CVE-2026-100749.md): Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension \< 6.5.0 (CVSS 5.1, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-97165](https://cve.now/CVE-2026-97165.md): Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension \< 6.5.0 (CVSS 5.3, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-15442](https://cve.now/CVE-2026-15442.md): Heap use-after-free on read during bidirectional (D)TLS shutdown (CVSS 2.3, wolfSSL)
- [CVE-2026-89102](https://cve.now/CVE-2026-89102.md): OCSP stapling v2 multi accepts non-CA chain certificates as issuers (CVSS 8.3, wolfSSL)
- [CVE-2026-89133](https://cve.now/CVE-2026-89133.md): NameConstraints not enforced across unconstrained intermediate CA (CVSS 6.3, wolfSSL)
- [CVE-2026-89134](https://cve.now/CVE-2026-89134.md): Subject CN name-constraint check bypassed when non-DNS SAN present (CVSS 6.3, wolfSSL)
- [CVE-2026-89135](https://cve.now/CVE-2026-89135.md): Failed X509\_verify\_cert leaves unverified CA in shared CertManager (CVSS 6.3, wolfSSL)
- [CVE-2026-89136](https://cve.now/CVE-2026-89136.md): Client accepts unsolicited RawPublicKey server certificate type (CVSS 8.3, wolfSSL)
- [CVE-2026-93302](https://cve.now/CVE-2026-93302.md): Trusted peer certificate match ignores public key, allowing forged CA clones (CVSS 8.3, wolfSSL)
- [CVE-2026-93304](https://cve.now/CVE-2026-93304.md): (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange (CVSS 6.3, wolfSSL)
- [CVE-2026-94417](https://cve.now/CVE-2026-94417.md): CRL check skipped when OCSP enabled and certificate has no OCSP URL (CVSS 2.3, wolfSSL)
- [CVE-2026-94418](https://cve.now/CVE-2026-94418.md): Signature failure masked by date error under WOLFSSL\_SMALL\_CERT\_VERIFY (CVSS 2.3, wolfSSL)
- [CVE-2026-94419](https://cve.now/CVE-2026-94419.md): Client session cache reference poisoning allows resumption with wrong server (CVSS 2.3, wolfSSL)
- [CVE-2026-100741](https://cve.now/CVE-2026-100741.md): Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer (CVSS 9.8, Progressive Robot hMailServer)
- [CVE-2026-97319](https://cve.now/CVE-2026-97319.md): PowerPress \< 11.17.2 - Contributor+ Stored XSS via Podcast Player Block (CVSS 6.8, PowerPress Podcasting plugin by Blubrry)
- [CVE-2026-97227](https://cve.now/CVE-2026-97227.md): NextScripts: Social Networks Auto-Poster \< 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion (CVSS 5.9, NextScripts: Social Networks Auto-Poster)
- [CVE-2026-96899](https://cve.now/CVE-2026-96899.md): Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq\_script (CVSS 6.8, Optima Express IDX)
- [CVE-2026-96897](https://cve.now/CVE-2026-96897.md): Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf\_clear\_cache (CVSS 5.3, Optima Express IDX)
- [CVE-2026-96896](https://cve.now/CVE-2026-96896.md): Malcure Malware Shield \< 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr\_ajax\_request (CVSS 7.2, Malcure Malware Shield — Removal, Repair, Monitor)
- [CVE-2026-96895](https://cve.now/CVE-2026-96895.md): WP YouTube Lyte \< 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes (CVSS 6.8, WP YouTube Lyte)
- [CVE-2026-92995](https://cve.now/CVE-2026-92995.md): Verge3D \<= 4.13.0 - Unauthenticated Product Download Disclosure via v3d\_download\_file (CVSS 5.3, Verge3D Publishing and E-Commerce)
- [CVE-2026-92436](https://cve.now/CVE-2026-92436.md): Mailchimp for WooCommerce \< 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR (CVSS 5.3, Mailchimp for WooCommerce)
- [CVE-2026-89006](https://cve.now/CVE-2026-89006.md): WPeMatico RSS Feed Fetcher \< 2.8.27 - Contributor+ Stored XSS via Feed Import (CVSS 6.8, WPeMatico RSS Feed Fetcher)
- [CVE-2026-89003](https://cve.now/CVE-2026-89003.md): WPeMatico RSS Feed Fetcher \< 2.8.27 - Contributor+ SSRF via Campaign Preview (CVSS 4.1, WPeMatico RSS Feed Fetcher)
- [CVE-2026-89001](https://cve.now/CVE-2026-89001.md): WPeMatico RSS Feed Fetcher \< 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings (CVSS 4.9, WPeMatico RSS Feed Fetcher)
- [CVE-2026-89000](https://cve.now/CVE-2026-89000.md): WPeMatico RSS Feed Fetcher \< 2.8.27 - Contributor+ SSRF via Campaign Run (CVSS 4.1, WPeMatico RSS Feed Fetcher)
- [CVE-2026-86841](https://cve.now/CVE-2026-86841.md): Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options (CVSS 4.7, Online Scheduling and Appointment Booking System)
- [CVE-2026-86839](https://cve.now/CVE-2026-86839.md): Bookly \< 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR (CVSS 3.8, Online Scheduling and Appointment Booking System)
- [CVE-2026-86609](https://cve.now/CVE-2026-86609.md): Download Manager Pro \< 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription (CVSS 8.8, Download Manager)
- [CVE-2026-85002](https://cve.now/CVE-2026-85002.md): EmbedPress \< 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes (CVSS 6.8, EmbedPress)
- [CVE-2026-82841](https://cve.now/CVE-2026-82841.md): UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice (CVSS 5.3, UpdraftPlus: WP Backup & Migration Plugin)
- [CVE-2026-81655](https://cve.now/CVE-2026-81655.md): Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields (CVSS 7.5, Ad Inserter)
- [CVE-2026-84069](https://cve.now/CVE-2026-84069.md): WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php (CVSS 5.3, WebFacing™)
- [CVE-2026-100746](https://cve.now/CVE-2026-100746.md): coollabsio Coolify GitHub App Setup redirect missing authentication (CVSS 6.9, coollabsio Coolify)
- [CVE-2026-100745](https://cve.now/CVE-2026-100745.md): Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow (CVSS 5.3, Edimax BR-6428nC)
- [CVE-2026-100837](https://cve.now/CVE-2026-100837.md): Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching (CVSS 6.3, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100836](https://cve.now/CVE-2026-100836.md): Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer (CVSS 5.3, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100865](https://cve.now/CVE-2026-100865.md): Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape (CVSS 8.7, heymrun heym)
- [CVE-2026-100864](https://cve.now/CVE-2026-100864.md): heym before 0.0.91 Remote Code Execution via Expression Engine (CVSS 8.7, heymrun heym)
- [CVE-2026-100863](https://cve.now/CVE-2026-100863.md): Heym before 0.0.91 SSRF via image fetching and IPv6 validation (CVSS 5.3, heymrun heym)
- [CVE-2026-100862](https://cve.now/CVE-2026-100862.md): heym before 0.0.91 Multiple Secrets Plaintext Storage (CVSS 6.9, heymrun heym)
- [CVE-2026-100861](https://cve.now/CVE-2026-100861.md): heym before 0.0.105 SSRF via credential-controlled base URLs (CVSS 5.3, heymrun heym)
- [CVE-2026-100860](https://cve.now/CVE-2026-100860.md): heym before 0.0.105 Authentication Bypass via Redis Node (CVSS 6.8, heymrun heym)
- [CVE-2026-100859](https://cve.now/CVE-2026-100859.md): Heym before 0.0.106 Credential Exfiltration via URL Override (CVSS 7.1, heymrun heym)
- [CVE-2026-100858](https://cve.now/CVE-2026-100858.md): heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes (CVSS 7.6, heymrun heym)
- [CVE-2026-100857](https://cve.now/CVE-2026-100857.md): AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation (CVSS 8.6, AzuraCast · azuracast/azuracast)
- [CVE-2026-100856](https://cve.now/CVE-2026-100856.md): AzuraCast before 0.23.6 Code Injection via Remote Relay Password (CVSS 8.7, AzuraCast · azuracast/azuracast)
- [CVE-2026-100855](https://cve.now/CVE-2026-100855.md): AzuraCast before 0.23.6 Missing Permission Check via /play (CVSS 7.1, AzuraCast · azuracast/azuracast)
- [CVE-2026-100854](https://cve.now/CVE-2026-100854.md): AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API (CVSS 5.3, AzuraCast · azuracast/azuracast)
- [CVE-2026-100853](https://cve.now/CVE-2026-100853.md): AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass (CVSS 8.2, AzuraCast)
- [CVE-2026-100852](https://cve.now/CVE-2026-100852.md): AzuraCast before 0.23.8 Command Injection via Streamer Username (CVSS 8.7, AzuraCast)
- [CVE-2026-100851](https://cve.now/CVE-2026-100851.md): AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile (CVSS 7.2, AzuraCast)
- [CVE-2026-100850](https://cve.now/CVE-2026-100850.md): AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist (CVSS 4.8, AzuraCast)
- [CVE-2026-100849](https://cve.now/CVE-2026-100849.md): AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs (CVSS 7.1, AzuraCast)
- [CVE-2026-100848](https://cve.now/CVE-2026-100848.md): AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL (CVSS 7.1, AzuraCast)
- [CVE-2026-100847](https://cve.now/CVE-2026-100847.md): AzuraCast before 0.23.8 DQL Injection via sortOrder (CVSS 8.7, AzuraCast)
- [CVE-2026-100846](https://cve.now/CVE-2026-100846.md): MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization (CVSS 8.8, Project-MONAI MONAI · monai)
- [CVE-2026-100845](https://cve.now/CVE-2026-100845.md): MONAI before 1.6.0 Remote Code Execution via NumpyReader (CVSS 8.5, Project-MONAI MONAI · monai)
- [CVE-2026-100844](https://cve.now/CVE-2026-100844.md): MONAI before 1.6.0 OS Command Injection via dataset\_name\_or\_id (CVSS 8.6, Project-MONAI MONAI · monai)
- [CVE-2026-100843](https://cve.now/CVE-2026-100843.md): MONAI before 1.6.0 Remote Code Execution via algo\_from\_pickle (CVSS 8.5, Project-MONAI MONAI · monai)
- [CVE-2026-100842](https://cve.now/CVE-2026-100842.md): MONAI through 1.6.0 \_get\_fake\_spatial\_shape eval() Sandbox Bypass via Attribute Chains (CVSS 7.3, Project-MONAI MONAI · monai)
- [CVE-2026-100841](https://cve.now/CVE-2026-100841.md): MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache (CVSS 8.5, Project-MONAI MONAI · monai)
- [CVE-2026-100840](https://cve.now/CVE-2026-100840.md): MONAI through 1.6.0 Remote Code Execution via bundle configuration (CVSS 8.5, Project-MONAI MONAI · monai)
- [CVE-2026-100839](https://cve.now/CVE-2026-100839.md): Contrast before 1.18.0 AML Injection Remote Code Execution (CVSS 8.4, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100838](https://cve.now/CVE-2026-100838.md): Contrast before 1.19.1 CopyFile Policy Symlink Subversion (CVSS 8.6, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100835](https://cve.now/CVE-2026-100835.md): Contrast before 1.16.0 Remote Attestation Relay Attack (CVSS 9.1, edgelesssys contrast)
- [CVE-2026-100834](https://cve.now/CVE-2026-100834.md): http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass (CVSS 8.2, http4k · org.http4k:http4k-security-digest)
- [CVE-2026-100833](https://cve.now/CVE-2026-100833.md): Contrast before 1.23.1 Image Substitution via Policy Generation (CVSS 8.6, edgelesssys contrast)
- [CVE-2026-100725](https://cve.now/CVE-2026-100725.md): http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage (CVSS 8.3, http4k · org.http4k:http4k-core)
- [CVE-2026-100724](https://cve.now/CVE-2026-100724.md): http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy (CVSS 6.3, http4k · org.http4k:http4k-core)
- [CVE-2026-100723](https://cve.now/CVE-2026-100723.md): vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool (CVSS 6.9, patriksimek vm2 · vm2)
- [CVE-2026-100722](https://cve.now/CVE-2026-100722.md): vm2 before 3.12.2 Host Process Termination via Construct Trap (CVSS 8.9, patriksimek vm2 · vm2)
- [CVE-2026-100721](https://cve.now/CVE-2026-100721.md): vm2 before 3.12.2 Authorization Bypass via Custom Resolver (CVSS 9.5, patriksimek vm2 · vm2)
- [CVE-2025-71426](https://cve.now/CVE-2025-71426.md): Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery (CVSS 7.1, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71425](https://cve.now/CVE-2025-71425.md): Contrast before 1.8.1 Information Disclosure via Logging (CVSS 8.5, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71424](https://cve.now/CVE-2025-71424.md): Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount (CVSS 5.1, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71423](https://cve.now/CVE-2025-71423.md): Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure (CVSS 8.5, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2025-71422](https://cve.now/CVE-2025-71422.md): Contrast before 1.12.1 Insecure LUKS2 Persistent Storage (CVSS 6.9, edgelesssys contrast · github.com/edgelesssys/contrast)
- [CVE-2026-100744](https://cve.now/CVE-2026-100744.md): coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization (CVSS 6.9, coollabsio Coolify)
- [CVE-2026-100740](https://cve.now/CVE-2026-100740.md): D-Link DIR-895L L2TP Control Channel tunnel.c tunnel\_set\_params out-of-bounds write (CVSS 9.4, D-Link DIR-895L)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.