# CVEs published 2026-09-28

314 CVEs were published on September 28, 2026: 46 critical, 93 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-101277](https://cve.now/CVE-2026-101277.md): Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim\_process\_set less trusted source (CVSS 6.9, Trusted Domain Project OpenDKIM)
- [CVE-2026-102367](https://cve.now/CVE-2026-102367.md): mall4j through 4.0 Insufficient Session Expiration via Token Refresh (CVSS 5.3, gz-yami mall4j)
- [CVE-2026-102366](https://cve.now/CVE-2026-102366.md): mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints (CVSS 2.1, gz-yami mall4j)
- [CVE-2026-102365](https://cve.now/CVE-2026-102365.md): mall4j through 4.0 Missing Authorization in Admin User Address Endpoints (CVSS 7.1, gz-yami mall4j)
- [CVE-2026-102364](https://cve.now/CVE-2026-102364.md): mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API (CVSS 5.3, gz-yami mall4j)
- [CVE-2026-102363](https://cve.now/CVE-2026-102363.md): mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number (CVSS 6.3, gz-yami mall4j)
- [CVE-2026-102362](https://cve.now/CVE-2026-102362.md): mall4j through 4.0 Missing Authentication in Product Review Deletion (CVSS 6.9, gz-yami mall4j)
- [CVE-2026-102361](https://cve.now/CVE-2026-102361.md): mall4j through 4.0 Missing Authentication in Password Update Endpoint (CVSS 9.3, gz-yami mall4j)
- [CVE-2026-101265](https://cve.now/CVE-2026-101265.md): Intelbras TIP 125i Básico sensitive information in source (CVSS 2.3, Intelbras TIP)
- [CVE-2026-18747](https://cve.now/CVE-2026-18747.md): Integer underflow of net\_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read (CVSS 6.8, zephyrproject zephyr)
- [CVE-2026-18746](https://cve.now/CVE-2026-18746.md): NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-18417](https://cve.now/CVE-2026-18417.md): Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-101264](https://cve.now/CVE-2026-101264.md): Ziroom ZHOME A0101 set\_passwd command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-101263](https://cve.now/CVE-2026-101263.md): Ziroom ZHOME A0101 set\_online\_client command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-101262](https://cve.now/CVE-2026-101262.md): Ziroom ZHOME A0101 set\_online\_client command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-101261](https://cve.now/CVE-2026-101261.md): Ziroom ZHOME A0101 firstSetup\_wifi command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-102335](https://cve.now/CVE-2026-102335.md): Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced\_config (CVSS 7.1, NginxProxyManager nginx-proxy-manager)
- [CVE-2026-102334](https://cve.now/CVE-2026-102334.md): Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection (CVSS 9.1, NginxProxyManager nginx-proxy-manager)
- [CVE-2026-102333](https://cve.now/CVE-2026-102333.md): httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL (CVSS 5.3, cle-b httpdbg)
- [CVE-2026-102332](https://cve.now/CVE-2026-102332.md): Dozzle before 11.1.2 Path Traversal via Log ZIP Download (CVSS 4.6, amir20 dozzle)
- [CVE-2026-101260](https://cve.now/CVE-2026-101260.md): Ziroom ZHOME A0101 firstLogin command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-102297](https://cve.now/CVE-2026-102297.md): ZoneMinder before 1.38.4 Incorrect Authorization in frames API index (CVSS 5.3, zoneminder)
- [CVE-2026-102296](https://cve.now/CVE-2026-102296.md): ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response (CVSS 8.3, zoneminder)
- [CVE-2026-101093](https://cve.now/CVE-2026-101093.md): Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion (CVSS 5.3, Cotonti)
- [CVE-2026-101092](https://cve.now/CVE-2026-101092.md): SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-101091](https://cve.now/CVE-2026-101091.md): SiYuan before v3.8.4 SQL Injection via Block Query Embed (CVSS 7.1, siyuan-note siyuan)
- [CVE-2024-58386](https://cve.now/CVE-2024-58386.md): ZoneMinder 1.37.x Path Traversal via files view (CVSS 7.1, zoneminder)
- [CVE-2026-101205](https://cve.now/CVE-2026-101205.md): FastStone Image Viewer PCX Decoder out-of-bounds (CVSS 5.3, FastStone Image Viewer)
- [CVE-2026-101204](https://cve.now/CVE-2026-101204.md): FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds (CVSS 5.3, FastStone Image Viewer)
- [CVE-2024-42002](https://cve.now/CVE-2024-42002.md): Unsafe use of eval() method in ros2 topic hz tool (CVSS 8.6, Open Source Robotics Foundation Robot Operating System)
- [CVE-2026-101203](https://cve.now/CVE-2026-101203.md): FastStone Image Viewer 1bpp RLE Decoder out-of-bounds write (CVSS 5.3, FastStone Image Viewer)
- [CVE-2026-102281](https://cve.now/CVE-2026-102281.md): Nest: Remote process termination via a deeply nested microservice message pattern (CVSS 7.5, nestjs nest · @nestjs/microservices)
- [CVE-2026-101202](https://cve.now/CVE-2026-101202.md): FastStone Image Viewer TGA Image out-of-bounds write (CVSS 5.3, FastStone Image Viewer)
- [CVE-2026-101188](https://cve.now/CVE-2026-101188.md): Netcore POWER13 ubus routerd.passwd\_set password recovery (CVSS 6.9, Netcore POWER13)
- [CVE-2026-102279](https://cve.now/CVE-2026-102279.md): Laravel: XSS in Debug Page Information (CVSS 3.1, laravel framework · laravel/framework)
- [CVE-2026-102278](https://cve.now/CVE-2026-102278.md): brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (CVSS 7.5, juliangruber brace-expansion · brace-expansion)
- [CVE-2026-97027](https://cve.now/CVE-2026-97027.md): Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files (CVSS 3.6, Red Hat Enterprise Linux)
- [CVE-2026-97026](https://cve.now/CVE-2026-97026.md): Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path (CVSS 3.9, Red Hat Enterprise Linux)
- [CVE-2026-97025](https://cve.now/CVE-2026-97025.md): Flatpak: flatpak: world-readable oci authentication token in system-helper cache path (CVSS 3.2, Red Hat Enterprise Linux)
- [CVE-2026-102277](https://cve.now/CVE-2026-102277.md): brace-expansion: Quadratic-time expansion of the \`{a},b}\` rewrite causes CPU denial of service (CVSS 5.3, juliangruber brace-expansion · brace-expansion)
- [CVE-2026-102276](https://cve.now/CVE-2026-102276.md): brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (CVSS 7.5, juliangruber brace-expansion · brace-expansion)
- [CVE-2026-102265](https://cve.now/CVE-2026-102265.md): PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header (CVSS 5.3, jpadilla pyjwt · pyjwt)
- [CVE-2026-102006](https://cve.now/CVE-2026-102006.md): VxWorks 7 Memory allocation (CVSS 5.5, Wind River Systems VxWorks)
- [CVE-2026-102275](https://cve.now/CVE-2026-102275.md): PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion (CVSS 6.5, jpadilla pyjwt · pyjwt)
- [CVE-2026-101187](https://cve.now/CVE-2026-101187.md): Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop\_usb\_device command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-91096](https://cve.now/CVE-2026-91096.md): In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases befor (CVSS 7.5, Facebook proxygen)
- [CVE-2026-91095](https://cve.now/CVE-2026-91095.md): In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiSt (CVSS 5.3, Facebook proxygen)
- [CVE-2026-84895](https://cve.now/CVE-2026-84895.md): In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSe (CVSS 7.3, Facebook proxygen)
- [CVE-2026-102274](https://cve.now/CVE-2026-102274.md): PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set (CVSS 5.9, jpadilla pyjwt · pyjwt)
- [CVE-2026-102273](https://cve.now/CVE-2026-102273.md): PyJWT accepts public JWK containers as HMAC secrets (CVSS 7.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-102272](https://cve.now/CVE-2026-102272.md): PyJWT BOM Bypass (CVSS 7.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-102271](https://cve.now/CVE-2026-102271.md): PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard (CVSS 7.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-101146](https://cve.now/CVE-2026-101146.md): Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure (CVSS 5.3, Eleveo Quality Management)
- [CVE-2026-102270](https://cve.now/CVE-2026-102270.md): PyJWT: ReDoS vulnerability when calling the \`is\_pem\_format\` function. (CVSS 4.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-102269](https://cve.now/CVE-2026-102269.md): PyJWT: Non-canonical signature segments enable raw-token revocation bypass (CVSS 4.8, jpadilla pyjwt · pyjwt)
- [CVE-2026-102268](https://cve.now/CVE-2026-102268.md): PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard (CVSS 9.1, jpadilla pyjwt · pyjwt)
- [CVE-2026-102267](https://cve.now/CVE-2026-102267.md): PyJWT: PyJWKClient follows redirects when fetching JWKS (CVSS 7.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-102266](https://cve.now/CVE-2026-102266.md): PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation (CVSS 7.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-100392](https://cve.now/CVE-2026-100392.md): InvoicePlane: Primary Administrator Privilege Downgrade via \`Users::form()\` (Missing Object-Level Authorization) (CVSS 7.0, InvoicePlane)
- [CVE-2026-102005](https://cve.now/CVE-2026-102005.md): VxWorks Memory Allocation (CVSS 5.5, Wind River VxWorks)
- [CVE-2026-100371](https://cve.now/CVE-2026-100371.md): InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery (CVSS 8.7, InvoicePlane)
- [CVE-2026-101145](https://cve.now/CVE-2026-101145.md): Eleveo Call Recording Software User Management userAddAction.do ldap injection (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-101918](https://cve.now/CVE-2026-101918.md): PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get\_signing\_key\_from\_jwt / verify\_signature=False) (CVSS 5.3, jpadilla pyjwt · pyjwt)
- [CVE-2026-101917](https://cve.now/CVE-2026-101917.md): PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) (CVSS 5.3, jpadilla pyjwt · pyjwt)
- [CVE-2026-100370](https://cve.now/CVE-2026-100370.md): DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation (CVSS 4.7, rhukster dom-sanitizer)
- [CVE-2026-101916](https://cve.now/CVE-2026-101916.md): @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized (CVSS 7.4, grpc-node · @grpc/grpc-js)
- [CVE-2026-101144](https://cve.now/CVE-2026-101144.md): Eleveo Call Recording Software Query Builder searchAction.do access control (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-18416](https://cve.now/CVE-2026-18416.md): Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match\_path\_uri) (CVSS 3.7, zephyrproject zephyr)
- [CVE-2026-18415](https://cve.now/CVE-2026-18415.md): Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames (CVSS 6.3, zephyrproject zephyr)
- [CVE-2026-18414](https://cve.now/CVE-2026-18414.md): Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc\_sequence buffer size validation (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-18413](https://cve.now/CVE-2026-18413.md): Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc\_sequence buffer size validation (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-16513](https://cve.now/CVE-2026-16513.md): Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-87741](https://cve.now/CVE-2026-87741.md): ConvertPlus \<= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter (CVSS 8.8, Brainstorm Force ConvertPlus)
- [CVE-2026-101915](https://cve.now/CVE-2026-101915.md): @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages (CVSS 3.7, grpc-node · @grpc/grpc-js)
- [CVE-2026-102004](https://cve.now/CVE-2026-102004.md): VxWorks 7 (CVSS 7.8, Wind River Systems VxWorks)
- [CVE-2026-101143](https://cve.now/CVE-2026-101143.md): Eleveo Quality Management QMBODownload information disclosure (CVSS 5.3, Eleveo Quality Management)
- [CVE-2026-96760](https://cve.now/CVE-2026-96760.md): Authlib library contains a signature‑verification bypass vulnerability (CVSS 9.8, Authlib)
- [CVE-2026-101914](https://cve.now/CVE-2026-101914.md): @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches (CVSS 6.5, grpc-node · @grpc/grpc-js-xds)
- [CVE-2026-101142](https://cve.now/CVE-2026-101142.md): Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal (CVSS 5.3, Eleveo Quality Management)
- [CVE-2026-93355](https://cve.now/CVE-2026-93355.md): LiteLLM Weak JWT Authentication via Email-Based User Lookup (CVSS 7.6, BerriAI litellm)
- [CVE-2026-101141](https://cve.now/CVE-2026-101141.md): Eleveo Call Recording Software Play Audio audio.jsp cross site scripting (CVSS 5.1, Eleveo Call Recording Software)
- [CVE-2026-86950](https://cve.now/CVE-2026-86950.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 8.8, KEV, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-101139](https://cve.now/CVE-2026-101139.md): Webkul Bagisto Invoice Mass Status Update state authorization (CVSS 5.1, Webkul Bagisto)
- [CVE-2026-102010](https://cve.now/CVE-2026-102010.md): Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase\_if (CVSS 7.0, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-97023](https://cve.now/CVE-2026-97023.md): Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-13018](https://cve.now/CVE-2026-13018.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perfor (CVSS 4.3, Google Chrome)
- [CVE-2026-97686](https://cve.now/CVE-2026-97686.md): VxWorks 7 Memory Resource leak (CVSS 5.5, Wind River VxWorks)
- [CVE-2026-101111](https://cve.now/CVE-2026-101111.md): Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) \< 6.4.6 (CVSS 5.3, ordasoft.com Book Library (Free) extension for Joomla)
- [CVE-2026-101132](https://cve.now/CVE-2026-101132.md): DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal (CVSS 2.3, deepseek-harness)
- [CVE-2026-101109](https://cve.now/CVE-2026-101109.md): Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) \< 6.5.8 (CVSS 5.3, ordasoft.com Vehicle Manager (Free) extension for Joomla)
- [CVE-2026-101110](https://cve.now/CVE-2026-101110.md): Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) \< 6.4.6 (CVSS 9.3, ordasoft.com Book Library (Free) extension for Joomla)
- [CVE-2026-100753](https://cve.now/CVE-2026-100753.md): Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) \< 6.7.9 (CVSS 5.3, ordasoft.com Real Estate Manager (Free) extension for Joomla)
- [CVE-2026-100752](https://cve.now/CVE-2026-100752.md): Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) \< 6.7.9 (CVSS 9.3, ordasoft.com Real Estate Manager (Free) extension for Joomla)
- [CVE-2026-84894](https://cve.now/CVE-2026-84894.md): In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidate (CVSS 7.5, Meta Platforms moxygen)
- [CVE-2026-101108](https://cve.now/CVE-2026-101108.md): Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) \< 6.5.8 (CVSS 9.3, ordasoft.com Vehicle Manager (Free) extension for Joomla)
- [CVE-2026-101131](https://cve.now/CVE-2026-101131.md): deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision (CVSS 4.8, deepseek-ai deepseek-harness)
- [CVE-2026-101105](https://cve.now/CVE-2026-101105.md): code-projects Matrimonial System Profile Creation Endpoint create\_profile processprofile\_form sql injection (CVSS 5.3, code-projects Matrimonial System)
- [CVE-2026-101102](https://cve.now/CVE-2026-101102.md): deepseek-ai deepseek-harness Code Mode Sandbox run\_code sandbox (CVSS 5.3, deepseek-ai deepseek-harness)
- [CVE-2026-49994](https://cve.now/CVE-2026-49994.md): Bluehood: Missing authentication on Bluehood API routes when web auth is enabled (CVSS 9.1, dannymcc bluehood)
- [CVE-2026-55160](https://cve.now/CVE-2026-55160.md): Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer (CVSS 7.6, stringer-rss stringer)
- [CVE-2026-101913](https://cve.now/CVE-2026-101913.md): ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts (CVSS 6.3, beaugunderson ip-address · ip-address)
- [CVE-2026-55156](https://cve.now/CVE-2026-55156.md): Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints (CVSS 5.3, ooples token-optimizer-mcp · @ooples/token-optimizer-mcp)
- [CVE-2026-55157](https://cve.now/CVE-2026-55157.md): Token Optimizer MCP: OS command injection in smart\_user via username in get-user-info (CVSS 8.4, ooples token-optimizer-mcp · @ooples/token-optimizer-mcp)
- [CVE-2026-101912](https://cve.now/CVE-2026-101912.md): ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range (CVSS 6.3, beaugunderson ip-address · ip-address)
- [CVE-2026-101911](https://cve.now/CVE-2026-101911.md): ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process (CVSS 6.3, beaugunderson ip-address · ip-address)
- [CVE-2026-101910](https://cve.now/CVE-2026-101910.md): ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass (CVSS 6.9, beaugunderson ip-address · ip-address)
- [CVE-2026-101101](https://cve.now/CVE-2026-101101.md): ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-101909](https://cve.now/CVE-2026-101909.md): Axios: Prototype Pollution Gadget in axios toFormData Options (CVSS 8.3, axios)
- [CVE-2026-75600](https://cve.now/CVE-2026-75600.md): FreePBX: Authenticated API generatedocs Host Command Injection (CVSS 8.6, FreePBX security-reporting)
- [CVE-2026-54710](https://cve.now/CVE-2026-54710.md): FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) (CVSS 8.6, FreePBX security-reporting)
- [CVE-2026-54708](https://cve.now/CVE-2026-54708.md): Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module (CVSS 8.6, FreePBX security-reporting)
- [CVE-2026-54675](https://cve.now/CVE-2026-54675.md): FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module (CVSS 8.7, FreePBX security-reporting)
- [CVE-2026-101908](https://cve.now/CVE-2026-101908.md): Axios: Prototype pollution gadget in fetch adapter can alter outbound requests (CVSS 6.9, axios)
- [CVE-2026-54674](https://cve.now/CVE-2026-54674.md): Authenticated Command Injection in FreePBX UCP Interface (CVSS 8.6, FreePBX security-reporting)
- [CVE-2026-45562](https://cve.now/CVE-2026-45562.md): FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module (CVSS 7.7, FreePBX security-reporting)
- [CVE-2026-101907](https://cve.now/CVE-2026-101907.md): Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF (CVSS 7.0, axios)
- [CVE-2026-101906](https://cve.now/CVE-2026-101906.md): Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (CVSS 8.2, axios)
- [CVE-2026-101905](https://cve.now/CVE-2026-101905.md): Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection (CVSS 7.6, axios)
- [CVE-2026-101100](https://cve.now/CVE-2026-101100.md): ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-101904](https://cve.now/CVE-2026-101904.md): Axios: Header Injection via Inherited headers After Minimal Interceptor (CVSS 6.9, axios)
- [CVE-2026-96740](https://cve.now/CVE-2026-96740.md): Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers (CVSS 6.5, Red Hat StreamsHub Console for Apache Kafka® · Red Hat stre…)
- [CVE-2026-101903](https://cve.now/CVE-2026-101903.md): Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (CVSS 8.2, axios)
- [CVE-2026-101902](https://cve.now/CVE-2026-101902.md): Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method (CVSS 6.9, axios)
- [CVE-2026-101901](https://cve.now/CVE-2026-101901.md): Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization (CVSS 8.2, axios)
- [CVE-2026-101099](https://cve.now/CVE-2026-101099.md): ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-101900](https://cve.now/CVE-2026-101900.md): Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders (CVSS 6.9, axios)
- [CVE-2026-101898](https://cve.now/CVE-2026-101898.md): Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls (CVSS 7.0, axios)
- [CVE-2026-101098](https://cve.now/CVE-2026-101098.md): ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-101894](https://cve.now/CVE-2026-101894.md): @xhmikosr/decompress: Path traversal via symlink chain (CVSS 9.1, XhmikosR decompress · kevva decompress +2)
- [CVE-2026-86102](https://cve.now/CVE-2026-86102.md): WatchGuard AP Command Injection in Internal Management API Allows Command Execution (CVSS 9.3, WatchGuard AP)
- [CVE-2026-87969](https://cve.now/CVE-2026-87969.md): WatchGuard AP Authenticated Command Injection in Diagnostic CLI (CVSS 8.6, WatchGuard AP)
- [CVE-2026-101891](https://cve.now/CVE-2026-101891.md): WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access (CVSS 9.3, WatchGuard AP)
- [CVE-2026-87114](https://cve.now/CVE-2026-87114.md): Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo (CVSS 7.1, Red Hat OpenShift Container Platform · Pen Drive Powered by…)
- [CVE-2026-101083](https://cve.now/CVE-2026-101083.md): PMWeb encryptionhelper.dll information disclosure (CVSS 6.9, PMWeb)
- [CVE-2026-48100](https://cve.now/CVE-2026-48100.md): Payy: agg\_agg trailing message slots are unconstrained and allow forged burn messages (CVSS 8.7, polybase payy)
- [CVE-2026-55096](https://cve.now/CVE-2026-55096.md): SSRF via DNS-resolution gap in \_validate\_url\_security (file download by URL) (CVSS 7.1, leshchenko1979 fast-mcp-telegram)
- [CVE-2026-54160](https://cve.now/CVE-2026-54160.md): Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB\_TOKEN (CVSS 8.2, networkupstools nut)
- [CVE-2026-101082](https://cve.now/CVE-2026-101082.md): PMWeb downloader.aspx path traversal (CVSS 6.9, PMWeb)
- [CVE-2026-101081](https://cve.now/CVE-2026-101081.md): D-Link DI-8400 Web Administration Service menu\_nat\_more.asp menu\_nat\_more\_asp stack-based overflow (CVSS 9.4, D-Link DI-8400)
- [CVE-2026-85644](https://cve.now/CVE-2026-85644.md): XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference (CVSS 7.5, XS-Parse-Keyword)
- [CVE-2026-88816](https://cve.now/CVE-2026-88816.md): DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName (CVSS 7.5, DBI)
- [CVE-2026-88815](https://cve.now/CVE-2026-88815.md): DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql\_type\_cast\_svpv (CVSS 6.2, DBI)
- [CVE-2026-101080](https://cve.now/CVE-2026-101080.md): Tencent AI-Infra-Guard File Access dir\_actions.py startsWith path traversal (CVSS 2.4, Tencent AI-Infra-Guard)
- [CVE-2026-88804](https://cve.now/CVE-2026-88804.md): Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher (CVSS 9.6, SUSE Rancher)
- [CVE-2026-88805](https://cve.now/CVE-2026-88805.md): Session Not Revoked Server-Side on Logout in Rancher (CVSS 8.1, SUSE Rancher)
- [CVE-2026-101861](https://cve.now/CVE-2026-101861.md): Langflow Code Execution via eval() in Component Input Schema (CVSS 2.1, langflow-ai langflow)
- [CVE-2026-12342](https://cve.now/CVE-2026-12342.md): SailPoint IdentityIQ Improper Form Validation Vulnerability (CVSS 9.6, SailPoint Technologies IdentityIQ)
- [CVE-2026-101079](https://cve.now/CVE-2026-101079.md): agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision (CVSS 2.4, agentverus-scanner)
- [CVE-2026-88808](https://cve.now/CVE-2026-88808.md): Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters (CVSS 8.8, SUSE Rancher)
- [CVE-2026-101078](https://cve.now/CVE-2026-101078.md): deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation (CVSS 4.8, deepseek-ai deepseek-harness)
- [CVE-2026-91154](https://cve.now/CVE-2026-91154.md): Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service (CVSS 6.9, MarcosCamara01 Ecommerce Template)
- [CVE-2026-97399](https://cve.now/CVE-2026-97399.md): One-byte overread in strncasecmp on Power8 (CVSS 3.7, The GNU C Library glibc)
- [CVE-2026-101077](https://cve.now/CVE-2026-101077.md): Netcore NR289-GE boa\_temp process\_request missing authentication (CVSS 10.0, Netcore NR289-GE)
- [CVE-2026-93348](https://cve.now/CVE-2026-93348.md): Unsloth Zoo Code Injection via model\_type in config.json (CVSS 8.6, unslothai unsloth-zoo · unslothai unsloth)
- [CVE-2026-101076](https://cve.now/CVE-2026-101076.md): Netcore NR289-GE CGI set\_ntp\_server\_ip.cgi system os command injection (CVSS 10.0, Netcore NR289-GE)
- [CVE-2026-93540](https://cve.now/CVE-2026-93540.md): Fleet applies namespace labels and annotations without the bundle's service account privileges (CVSS 6.5, SUSE Rancher)
- [CVE-2026-101075](https://cve.now/CVE-2026-101075.md): Netcore NR289-GE Location Time location\_time.cgi system os command injection (CVSS 10.0, Netcore NR289-GE)
- [CVE-2026-96538](https://cve.now/CVE-2026-96538.md): WarehousePG pg\_file\_write/pg\_file\_rename/pg\_file\_unlink/pg\_logdir\_ls privilege escalation (CVSS 8.7, EnterpriseDB WarehousePG)
- [CVE-2026-101333](https://cve.now/CVE-2026-101333.md): Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint (CVSS 3.7, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-101074](https://cve.now/CVE-2026-101074.md): Netcore NR289-GE Authentication boa password-check stack-based overflow (CVSS 9.3, Netcore NR289-GE)
- [CVE-2026-4556](https://cve.now/CVE-2026-4556.md): macOS Exam4 Local Privilege Escalation via Command Injection (CVSS 7.8, Extegrity Exam4)
- [CVE-2026-70413](https://cve.now/CVE-2026-70413.md): Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. (CVSS 5.6, Dell Live Optics Collector)
- [CVE-2026-80359](https://cve.now/CVE-2026-80359.md): Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access (CVSS 6.8, Dell Boot Optimized Server Storage)
- [CVE-2026-80358](https://cve.now/CVE-2026-80358.md): Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access (CVSS 5.1, Dell Boot Optimized Server Storage)
- [CVE-2026-93539](https://cve.now/CVE-2026-93539.md): Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver (CVSS 5.4, SUSE Rancher)
- [CVE-2026-80357](https://cve.now/CVE-2026-80357.md): Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access (CVSS 7.0, Dell Boot Optimized Server Storage)
- [CVE-2026-93538](https://cve.now/CVE-2026-93538.md): Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet (CVSS 7.1, SUSE Rancher)
- [CVE-2026-101073](https://cve.now/CVE-2026-101073.md): Netcore NR289-GE CGI Dispatcher boa improper authentication (CVSS 6.9, Netcore NR289-GE)
- [CVE-2026-90924](https://cve.now/CVE-2026-90924.md): Default Admin Credentials in Innotim Software's Logsign SIEM (CVSS 9.8, Innotim Software, Telecommunications and Consultancy Trade…)
- [CVE-2026-90925](https://cve.now/CVE-2026-90925.md): Path Traversal in Innotim Software's Logsign SIEM (CVSS 7.1, Innotim Software, Telecommunications and Consultancy Trade…)
- [CVE-2026-90926](https://cve.now/CVE-2026-90926.md): Code Injection in Innotim Software's Logsign SIEM (CVSS 8.8, Innotim Software, Telecommunications and Consultancy Trade…)
- [CVE-2026-101072](https://cve.now/CVE-2026-101072.md): Netcore NR289-GE CGI ap\_ip.cgi system os command injection (CVSS 10.0, Netcore NR289-GE)
- [CVE-2026-101071](https://cve.now/CVE-2026-101071.md): Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload (CVSS 5.3, Acrel Electric Unet Web Service)
- [CVE-2026-93537](https://cve.now/CVE-2026-93537.md): Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory (CVSS 6.5, SUSE Rancher)
- [CVE-2026-87798](https://cve.now/CVE-2026-87798.md): LXD client recursive file pull allows directory escape via malicious VM agent (CVSS 5.8, Canonical LXD)
- [CVE-2026-87799](https://cve.now/CVE-2026-87799.md): Arbitrary file write on LXD host via symlink in migration stream (CVSS 9.9, Canonical LXD)
- [CVE-2026-97335](https://cve.now/CVE-2026-97335.md): Incorrect authorization in LXD storage volume API allows reading volumes from other projects (CVSS 7.7, Canonical LXD)
- [CVE-2026-85185](https://cve.now/CVE-2026-85185.md): Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root (CVSS 9.6, Canonical LXD)
- [CVE-2026-85526](https://cve.now/CVE-2026-85526.md): Path traversal via Btrfs optimized-backup subvolumes\[\].path enables root file/dir manipulation in LXD (CVSS 9.9, Canonical LXD)
- [CVE-2026-86335](https://cve.now/CVE-2026-86335.md): LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse (CVSS 6.3, Canonical LXD)
- [CVE-2026-86334](https://cve.now/CVE-2026-86334.md): CLI Path Traversal via Content-Disposition in LXD Image Export/Copy (CVSS 4.2, Canonical LXD)
- [CVE-2026-15953](https://cve.now/CVE-2026-15953.md): Path Traversal During Project Archive Import (CVSS 5.0, ABB Protection and control IED manager)
- [CVE-2026-101070](https://cve.now/CVE-2026-101070.md): dbgate Files Endpoint runners.js files path traversal (CVSS 6.9, dbgate)
- [CVE-2026-86595](https://cve.now/CVE-2026-86595.md): SQLi in Iron Mountain's enVision (CVSS 8.8, Iron Mountain Archiving Services enVision)
- [CVE-2026-73642](https://cve.now/CVE-2026-73642.md): Path Traversal in Dayforce ESS Excelity (CVSS 9.2, Dayforce ESS Excelity)
- [CVE-2026-73641](https://cve.now/CVE-2026-73641.md): Multiple Reflected XSS in Dayforce ESS Excelity (CVSS 5.1, Dayforce ESS Excelity)
- [CVE-2026-73640](https://cve.now/CVE-2026-73640.md): Time-based SQL Injection in Dayforce ESS Excelity (CVSS 9.3, Dayforce ESS Excelity)
- [CVE-2026-15952](https://cve.now/CVE-2026-15952.md): Improper Permission Assignment in Scheduler Service (CVSS 6.4, ABB Protection and control IED manager)
- [CVE-2026-52749](https://cve.now/CVE-2026-52749.md): Improper Authentication in Kaon AR2140X (CVSS 5.3, Kaon AR2140)
- [CVE-2026-52748](https://cve.now/CVE-2026-52748.md): Missing authentication for backup functionality in Kaon AR2140X (CVSS 7.1, Kaon AR2140)
- [CVE-2026-101069](https://cve.now/CVE-2026-101069.md): dbgate Export databaseConnections.js exportModelSql path traversal (CVSS 6.9, dbgate)
- [CVE-2026-59563](https://cve.now/CVE-2026-59563.md): HMAC Confirmation Token Unbinding in zscaler-mcp-server (CVSS 4.6, zscaler-mcp-server)
- [CVE-2026-101068](https://cve.now/CVE-2026-101068.md): dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal (CVSS 6.9, dbgate)
- [CVE-2026-101292](https://cve.now/CVE-2026-101292.md): Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization (CVSS 8.2, Red Hat JBoss Enterprise Application Platform · Red Hat AMQ…)
- [CVE-2026-82323](https://cve.now/CVE-2026-82323.md): Improper Authorization in Enocta Educational's Enocta Platform (CVSS 8.1, Enocta Educational Technologies Enocta Platform)
- [CVE-2026-82326](https://cve.now/CVE-2026-82326.md): HTML Injection in Enocta Educational's Enocta Platform (CVSS 4.1, Enocta Educational Technologies Enocta Platform)
- [CVE-2026-18825](https://cve.now/CVE-2026-18825.md): Origin validation error in the connect-xcors npm package (CVSS 5.3, github.com/antono connect-cors)
- [CVE-2026-101067](https://cve.now/CVE-2026-101067.md): dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal (CVSS 6.9, dbgate)
- [CVE-2026-12265](https://cve.now/CVE-2026-12265.md): Missing Authorization on HA Failover Config allows Complete Data Destruction (CVSS 8.8, Zohocorp DDI Central)
- [CVE-2026-86330](https://cve.now/CVE-2026-86330.md): Noobaa-core: noobaa-core: os command injection in cluster\_internal\_api.set\_hostname\_internal (CVSS 7.2, Red Hat Openshift Data Foundation)
- [CVE-2026-101066](https://cve.now/CVE-2026-101066.md): dbgate Archive Link Creation archive.js createLink path traversal (CVSS 6.9, dbgate)
- [CVE-2026-82936](https://cve.now/CVE-2026-82936.md): Denial of Service in mH-DEVELOPER (CVSS 5.9, F&F Filipowski mH-DEVELOPER)
- [CVE-2026-82935](https://cve.now/CVE-2026-82935.md): Use of End-of-Life components in mH-DEVELOPER (CVSS 6.9, F&F Filipowski mH-DEVELOPER)
- [CVE-2026-82933](https://cve.now/CVE-2026-82933.md): Cleartext Transmission of Sensitive Information in mH-DEVELOPER (CVSS 6.0, F&F Filipowski mH-DEVELOPER)
- [CVE-2026-82932](https://cve.now/CVE-2026-82932.md): Missing Firewall Configuration in mH-DEVELOPER (CVSS 5.3, F&F Filipowski mH-DEVELOPER)
- [CVE-2026-82930](https://cve.now/CVE-2026-82930.md): Missing Authentication in mH-DEVELOPER (CVSS 6.4, F&F Filipowski mH-DEVELOPER)
- [CVE-2026-82929](https://cve.now/CVE-2026-82929.md): Use of Shared Cryptographic Key in mH-DEVELOPER (CVSS 6.3, F&F Filipowski mH-DEVELOPER)
- [CVE-2026-82928](https://cve.now/CVE-2026-82928.md): Undocumented access path in mH-DEVELOPER (CVSS 7.7, F&F Filipowski mH-DEVELOPER)
- [CVE-2026-101055](https://cve.now/CVE-2026-101055.md): Thinkware U3000 TCP Service GET\_STATUS information disclosure (CVSS 6.9, Thinkware U3000)
- [CVE-2026-12264](https://cve.now/CVE-2026-12264.md): Authenticated File Write via HA Failover Config Upload leads to RCE (CVSS 8.8, Zohocorp DDI Central)
- [CVE-2026-101054](https://cve.now/CVE-2026-101054.md): Thinkware U3000 TCP Service wpa\_supplicant.conf get\_file access control (CVSS 6.9, Thinkware U3000)
- [CVE-2026-78424](https://cve.now/CVE-2026-78424.md): OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes (CVSS 8.8, SUSE NeuVector)
- [CVE-2026-19444](https://cve.now/CVE-2026-19444.md): Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes (CVSS 6.5, Kubernetes)
- [CVE-2026-87752](https://cve.now/CVE-2026-87752.md): HTML Injection in Rolantis Information Technologies' Agentis (CVSS 6.1, Rolantis Information Technologies Tourism Industry and Trad…)
- [CVE-2026-101053](https://cve.now/CVE-2026-101053.md): Thinkware U3000 TCP Service wpa\_supplicant.conf PUT\_FILE access control (CVSS 6.9, Thinkware U3000)
- [CVE-2026-94194](https://cve.now/CVE-2026-94194.md): Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries (CVSS 6.3, elixir-mint mint · mint)
- [CVE-2026-92103](https://cve.now/CVE-2026-92103.md): Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max\_frame\_size (CVSS 6.3, elixir-mint mint · mint)
- [CVE-2026-91043](https://cve.now/CVE-2026-91043.md): HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max\_header\_list\_size and exhaust client memory (CVSS 8.2, elixir-mint mint · mint)
- [CVE-2026-101052](https://cve.now/CVE-2026-101052.md): refly-ai refly JWT Token app.config.ts hard-coded credentials (CVSS 6.9, refly-ai refly)
- [CVE-2026-101040](https://cve.now/CVE-2026-101040.md): Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service (CVSS 7.1, Ricoh SP 330DN · Ricoh SP +1)
- [CVE-2026-12267](https://cve.now/CVE-2026-12267.md): Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE (CVSS 7.2, Zohocorp DDI Central)
- [CVE-2026-81375](https://cve.now/CVE-2026-81375.md): Confused Deputy in Application Integration allows Internal File Read (CVSS 8.3, Google Cloud Application Integration)
- [CVE-2026-12268](https://cve.now/CVE-2026-12268.md): Authenticated PowerShell Injection leads to RCE (CVSS 8.8, Zohocorp DDI Central)
- [CVE-2026-81867](https://cve.now/CVE-2026-81867.md): Deserialization of Untrusted Data in Application Integration allows Remote Code Execution (CVSS 9.4, Google Cloud Application Integration)
- [CVE-2026-101039](https://cve.now/CVE-2026-101039.md): FAST FAC1900R devdiscover Service copy\_msg\_element stack-based overflow (CVSS 10.0, FAST FAC1900R)
- [CVE-2026-91006](https://cve.now/CVE-2026-91006.md): Apache Karaf: OS Command Injection in Child-Instance Launch (instance:\* / InstancesMBean) (CVSS 8.8, Apache Software Foundation Apache Karaf)
- [CVE-2026-12269](https://cve.now/CVE-2026-12269.md): Authenticated File Write to RCE via keepalived in DDI Central (CVSS 8.8, Zohocorp DDI Central)
- [CVE-2026-19759](https://cve.now/CVE-2026-19759.md): Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution (CVSS 9.4, Google Cloud Application Integration)
- [CVE-2026-101038](https://cve.now/CVE-2026-101038.md): FAST FAC1200R MmtAtePrase stack-based overflow (CVSS 9.4, FAST FAC1200R)
- [CVE-2026-101037](https://cve.now/CVE-2026-101037.md): FAST FAC1200R devdiscover Service parse\_advertisement\_frame stack-based overflow (CVSS 9.4, FAST FAC1200R)
- [CVE-2026-7171](https://cve.now/CVE-2026-7171.md): Stored Cross-Site Scripting (XSS) in TPVEnlanube (CVSS 4.8, TPVEnlanube Cloud Web application)
- [CVE-2026-7172](https://cve.now/CVE-2026-7172.md): Stored Cross-Site Scripting (XSS) in TPVEnlanube (CVSS 4.8, TPVEnlanube Cloud Web application)
- [CVE-2026-7170](https://cve.now/CVE-2026-7170.md): Stored Cross-Site Scripting (XSS) in TPVEnlanube (CVSS 4.8, TPVEnlanube Cloud Web application)
- [CVE-2026-101036](https://cve.now/CVE-2026-101036.md): FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal (CVSS 4.8, FLB-Music-Player)
- [CVE-2026-90979](https://cve.now/CVE-2026-90979.md): Apache Karaf: LDAP filter injection in JAAS LDAP login modules (CVSS 7.3, Apache Software Foundation Apache Karaf)
- [CVE-2026-101035](https://cve.now/CVE-2026-101035.md): aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception (CVSS 6.9, aligungr UERANSIM)
- [CVE-2026-101018](https://cve.now/CVE-2026-101018.md): dayrui XunruiCMS Group Editing Home.php group\_all\_edit sql injection (CVSS 5.1, dayrui XunruiCMS)
- [CVE-2026-101017](https://cve.now/CVE-2026-101017.md): Trusted Domain Project OpenDMARC opendmarc\_policy.c strcasecmp exceptional condition (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-94287](https://cve.now/CVE-2026-94287.md): Denial of service via unsigned underflow in libXpm's write path (CVSS 5.5, x.org libXpm)
- [CVE-2026-94286](https://cve.now/CVE-2026-94286.md): Out-of-bounds read in libXtst's RECORD reply parser (CVSS 7.1, x.org libXtst)
- [CVE-2026-94285](https://cve.now/CVE-2026-94285.md): Out-of-bounds read in libX11's byte-oriented codeset parser (CVSS 5.1, x.org libX11)
- [CVE-2026-101016](https://cve.now/CVE-2026-101016.md): Trusted Domain Project OpenDMARC opendmarc\_policy.c opendmarc\_policy\_parse\_dmarc exceptional condition (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-94284](https://cve.now/CVE-2026-94284.md): Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser (CVSS 5.5, x.org libX11)
- [CVE-2026-94283](https://cve.now/CVE-2026-94283.md): Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (CVSS 6.5, x.org libX11)
- [CVE-2026-82915](https://cve.now/CVE-2026-82915.md): Path Traversal in Bimser Solution Software's eBA Plus (CVSS 6.5, Bimser Solution Software Trade eBA Plus Document and Workfl…)
- [CVE-2026-101015](https://cve.now/CVE-2026-101015.md): Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-85134](https://cve.now/CVE-2026-85134.md): Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus (CVSS 8.8, Bimser Solution Software Trade eBA Plus Document and Workfl…)
- [CVE-2026-86507](https://cve.now/CVE-2026-86507.md): Apache Roller: Stored XSS in comment moderation via comment author URL (CVSS 6.1, Apache Software Foundation Apache Roller)
- [CVE-2026-82969](https://cve.now/CVE-2026-82969.md): Stored XSS in BİMSER's eBA Plus (CVSS 5.4, Bimser Solution Software Trade eBA Plus Document and Workfl…)
- [CVE-2026-94282](https://cve.now/CVE-2026-94282.md): Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion (CVSS 5.6, x.org libXi)
- [CVE-2026-101014](https://cve.now/CVE-2026-101014.md): Trusted Domain Project OpenDMARC DMARC Record opendmarc\_util.c opendmarc\_util\_cleanup off-by-one (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-95104](https://cve.now/CVE-2026-95104.md): Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. (CVSS 7.5, BUFFALO WSR-300HP · BUFFALO WEX-G300)
- [CVE-2026-86530](https://cve.now/CVE-2026-86530.md): BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. (CVSS 7.2, BUFFALO WSR-300HP · BUFFALO WEX-G300)
- [CVE-2026-101013](https://cve.now/CVE-2026-101013.md): mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-82379](https://cve.now/CVE-2026-82379.md): Apache Roller: WSSE digest authentication headers can be replayed (CVSS 7.7, Apache Software Foundation Apache Roller)
- [CVE-2026-82380](https://cve.now/CVE-2026-82380.md): Apache Roller: CSRF protection bypass via self-generated salt validation (CVSS 8.1, Apache Software Foundation Apache Roller)
- [CVE-2026-82381](https://cve.now/CVE-2026-82381.md): Apache Roller: Stored cross-site scripting in the authoring UI (CVSS 5.4, Apache Software Foundation Apache Roller)
- [CVE-2026-82382](https://cve.now/CVE-2026-82382.md): Apache Roller: Reflected cross-site scripting in the frontpage directory parameter (CVSS 6.1, Apache Software Foundation Apache Roller)
- [CVE-2026-82383](https://cve.now/CVE-2026-82383.md): Apache Roller: Anonymous setup action allows frontpage configuration tampering (CVSS 8.2, Apache Software Foundation Apache Roller)
- [CVE-2026-82384](https://cve.now/CVE-2026-82384.md): Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint (CVSS 9.8, Apache Software Foundation Apache Roller)
- [CVE-2026-82375](https://cve.now/CVE-2026-82375.md): Apache Roller: Server-side request forgery via entry trackback and enclosure URLs (CVSS 7.4, Apache Software Foundation Apache Roller)
- [CVE-2026-82376](https://cve.now/CVE-2026-82376.md): Apache Roller: XML external entity processing in trackback response parser (CVSS 7.7, Apache Software Foundation Apache Roller)
- [CVE-2026-82377](https://cve.now/CVE-2026-82377.md): Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers (CVSS 9.9, Apache Software Foundation Apache Roller)
- [CVE-2026-82378](https://cve.now/CVE-2026-82378.md): Apache Roller: OAuth authorization endpoint trusts request-supplied identity (CVSS 9.0, Apache Software Foundation Apache Roller)
- [CVE-2026-101012](https://cve.now/CVE-2026-101012.md): mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection (CVSS 6.9, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-82385](https://cve.now/CVE-2026-82385.md): Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files (CVSS 6.5, Apache Software Foundation Apache Roller)
- [CVE-2026-82386](https://cve.now/CVE-2026-82386.md): Apache Roller: XML external entity processing in OPML bookmark import (CVSS 7.7, Apache Software Foundation Apache Roller)
- [CVE-2026-82348](https://cve.now/CVE-2026-82348.md): Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups (CVSS 7.7, Apache Software Foundation Apache Roller)
- [CVE-2026-82387](https://cve.now/CVE-2026-82387.md): Apache Roller: Stored cross-site scripting via uploaded media content type (CVSS 5.4, Apache Software Foundation Apache Roller)
- [CVE-2026-82546](https://cve.now/CVE-2026-82546.md): Apache Roller: Stored cross-site scripting through incoming Trackback links (CVSS 6.1, Apache Software Foundation Apache Roller)
- [CVE-2026-91204](https://cve.now/CVE-2026-91204.md): Apache Roller: Stored javascript: URI in HTML comments (CVSS 6.1, Apache Software Foundation Apache Roller)
- [CVE-2026-91206](https://cve.now/CVE-2026-91206.md): Apache Roller: Reflected XSS in the optional LDAP comment authenticator (CVSS 6.1, Apache Software Foundation Apache Roller)
- [CVE-2026-101011](https://cve.now/CVE-2026-101011.md): aaPanel BaoTa Domain domainMod.py get\_domain\_status sql injection (CVSS 5.1, aaPanel BaoTa)
- [CVE-2026-101010](https://cve.now/CVE-2026-101010.md): aaPanel BaoTa data.py getData sql injection (CVSS 5.1, aaPanel BaoTa)
- [CVE-2026-100750](https://cve.now/CVE-2026-100750.md): Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla (CVSS 8.5, regularlabs.com Modules Anywhere (Pro) extension for Joomla)
- [CVE-2026-101009](https://cve.now/CVE-2026-101009.md): aaPanel BaoTa Unzip panelTask.py panelTask.bt\_task.\_unzip os command injection (CVSS 9.3, aaPanel BaoTa)
- [CVE-2026-100751](https://cve.now/CVE-2026-100751.md): Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 (CVSS 7.5, regularlabs.com Tabs & Accordions (Free, Pro) extension for…)
- [CVE-2026-101008](https://cve.now/CVE-2026-101008.md): aaPanel BaoTa File Merge files.py merge\_split\_file command injection (CVSS 9.4, aaPanel BaoTa)
- [CVE-2026-101007](https://cve.now/CVE-2026-101007.md): aaPanel BaoTa Database Backup database.py InputSql os command injection (CVSS 9.3, aaPanel BaoTa)
- [CVE-2026-92996](https://cve.now/CVE-2026-92996.md): Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d\_payment\_done (CVSS 5.3, Verge3D Publishing and E-Commerce)
- [CVE-2026-89411](https://cve.now/CVE-2026-89411.md): Paymattic \< 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent (CVSS 5.3, Paymattic)
- [CVE-2026-88828](https://cve.now/CVE-2026-88828.md): Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords (CVSS 5.4, Blacklist Manager)
- [CVE-2026-86838](https://cve.now/CVE-2026-86838.md): Bookly \< 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation (CVSS 5.3, Bookly)
- [CVE-2026-84744](https://cve.now/CVE-2026-84744.md): WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation (CVSS 6.5, WPForms)
- [CVE-2026-101006](https://cve.now/CVE-2026-101006.md): Frappe HR Permission Validation \_\_init\_\_.py get\_attendance\_requests authorization (CVSS 5.3, Frappe HR)
- [CVE-2026-89300](https://cve.now/CVE-2026-89300.md): WP Verify API \<= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients (CVSS 5.3, WP Verify API)
- [CVE-2026-93000](https://cve.now/CVE-2026-93000.md): SPS-Suite \<= 1.4.0 - Unauthenticated Time-Based SQLi via Search (CVSS 6.8, SPS-Suite)
- [CVE-2026-89303](https://cve.now/CVE-2026-89303.md): Post Voting System \<= 1.0 - Subscriber+ SQLi via 'row' Parameter (CVSS 6.4, Post Voting System)
- [CVE-2026-101005](https://cve.now/CVE-2026-101005.md): October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery (CVSS 6.9, October CMS)
- [CVE-2026-101004](https://cve.now/CVE-2026-101004.md): notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication (CVSS 6.9, notionnext-org NotionNext)
- [CVE-2026-101003](https://cve.now/CVE-2026-101003.md): Cesanta Mongoose MQTT Broker main.c fn stack-based overflow (CVSS 6.9, Cesanta Mongoose)
- [CVE-2026-101002](https://cve.now/CVE-2026-101002.md): Netcore NBR200V2 Tools Ping network\_tools system os command injection (CVSS 9.4, Netcore NBR200V2)
- [CVE-2026-101001](https://cve.now/CVE-2026-101001.md): Netcore NBR200V2 Web Management network\_tools eval os command injection (CVSS 10.0, Netcore NBR200V2)
- [CVE-2026-101000](https://cve.now/CVE-2026-101000.md): Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization (CVSS 10.0, Netcore NBR100V2)
- [CVE-2026-100909](https://cve.now/CVE-2026-100909.md): OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery (CVSS 6.9, OctoberCMS · october/october)
- [CVE-2026-100908](https://cve.now/CVE-2026-100908.md): Eyeplus p2pcam HTTP stack-based overflow (CVSS 8.7, Eyeplus)
- [CVE-2026-87723](https://cve.now/CVE-2026-87723.md): Untrusted Search Path (PATH Hijacking) in fuse-archive (CVSS 5.4, Google fuse-archive)
- [CVE-2026-100907](https://cve.now/CVE-2026-100907.md): Eyeplus p2pcam Service snapshot information disclosure (CVSS 6.9, Eyeplus)
- [CVE-2026-100906](https://cve.now/CVE-2026-100906.md): Eyeplus ONVIF Device GetUsers information disclosure (CVSS 6.9, Eyeplus)
- [CVE-2026-100904](https://cve.now/CVE-2026-100904.md): amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting (CVSS 5.1, amirsanni mini-inventory-and-sales-management-system)
- [CVE-2026-100903](https://cve.now/CVE-2026-100903.md): ООО НПО Ритм GEOritm REST API obj-groups missing authentication (CVSS 6.9, ООО НПО Ритм GEOritm)
- [CVE-2026-100902](https://cve.now/CVE-2026-100902.md): Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input (CVSS 7.1, Barco ClickShare CX-20 Gen2)
- [CVE-2026-100901](https://cve.now/CVE-2026-100901.md): athlon1600 youtube-downloader stream.php stream server-side request forgery (CVSS 6.9, athlon1600 youtube-downloader)
- [CVE-2026-100900](https://cve.now/CVE-2026-100900.md): DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery (CVSS 5.1, DevaslanPHP project-management)
- [CVE-2026-100899](https://cve.now/CVE-2026-100899.md): DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection (CVSS 5.3, DevaslanPHP project-management)
- [CVE-2026-100898](https://cve.now/CVE-2026-100898.md): DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection (CVSS 5.3, DevaslanPHP project-management)
- [CVE-2026-100897](https://cve.now/CVE-2026-100897.md): fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization (CVSS 5.1, fuzui StudentInfo)
- [CVE-2026-100896](https://cve.now/CVE-2026-100896.md): TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection (CVSS 9.4, TOTOLINK N150RT)
- [CVE-2026-100895](https://cve.now/CVE-2026-100895.md): Trusted Domain Project OpenARC libopenarc arc-canon.c arc\_parse\_canon\_t null pointer dereference (CVSS 6.9, Trusted Domain Project OpenARC)
- [CVE-2026-100894](https://cve.now/CVE-2026-100894.md): mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection (CVSS 5.3, mathurvishal CloudClassroom-PHP-Project)
- [CVE-2026-100893](https://cve.now/CVE-2026-100893.md): Privoce VoceChat Server open\_graphic\_parse Endpoint resource.rs fetch server-side request forgery (CVSS 6.9, Privoce VoceChat Server)
- [CVE-2026-100892](https://cve.now/CVE-2026-100892.md): aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruption (CVSS 6.9, aligungr UERANSIM)
- [CVE-2026-100891](https://cve.now/CVE-2026-100891.md): Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc\_policy.c opendmarc\_policy\_query\_dmarc encoding error (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-100890](https://cve.now/CVE-2026-100890.md): Trusted Domain Project OpenDMARC SPF Parser opendmarc\_spf.c opendmarc\_spf\_ipv6\_explode null pointer dereference (CVSS 6.9, Trusted Domain Project OpenDMARC)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.