# CVEs published 2026-09-29

611 CVEs were published on September 29, 2026: 97 critical, 251 high. Days are UTC.

- [CVE-2026-102794](https://cve.now/CVE-2026-102794.md): Ziroom ZHOME A0101 ping command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-102793](https://cve.now/CVE-2026-102793.md): Ziroom ZHOME A0101 set\_time\_zone command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-103051](https://cve.now/CVE-2026-103051.md): Stored i18n XSSs in CentralNotice (CVSS 6.1, The Wikimedia Foundation Mediawiki - CentralNotice extension)
- [CVE-2026-103050](https://cve.now/CVE-2026-103050.md): Stored i18n XSS in MassMessage (CVSS 6.1, The Wikimedia Foundation Mediawiki - MassMessage extension)
- [CVE-2026-103049](https://cve.now/CVE-2026-103049.md): XSS in Cargo's Special:CargoQuery page due to unsanitized table headers (CVSS 6.1, The Wikimedia Foundation Mediawiki - Cargo extension)
- [CVE-2026-86104](https://cve.now/CVE-2026-86104.md): Fireware OS Resource Exhaustion in Login Process Allows Denial of Service (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-18145](https://cve.now/CVE-2026-18145.md): Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution (CVSS 8.6, WatchGuard Fireware OS)
- [CVE-2026-86101](https://cve.now/CVE-2026-86101.md): Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access (CVSS 7.2, WatchGuard Fireware OS)
- [CVE-2026-13046](https://cve.now/CVE-2026-13046.md): Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution (CVSS 7.5, WatchGuard Fireware OS)
- [CVE-2026-86131](https://cve.now/CVE-2026-86131.md): Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution (CVSS 9.2, WatchGuard Fireware OS)
- [CVE-2026-13224](https://cve.now/CVE-2026-13224.md): Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read (CVSS 8.2, WatchGuard Fireware OS)
- [CVE-2026-86133](https://cve.now/CVE-2026-86133.md): Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service (CVSS 8.2, WatchGuard Fireware OS)
- [CVE-2026-90441](https://cve.now/CVE-2026-90441.md): Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B (CVSS 7.1, WatchGuard Fireware OS)
- [CVE-2026-18105](https://cve.now/CVE-2026-18105.md): Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service (CVSS 7.1, WatchGuard Fireware OS)
- [CVE-2026-86105](https://cve.now/CVE-2026-86105.md): Fireware OS Improper Authorization in Access Portal Reverse Proxy (CVSS 5.3, WatchGuard Fireware OS)
- [CVE-2026-86136](https://cve.now/CVE-2026-86136.md): Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A (CVSS 7.1, WatchGuard Fireware OS)
- [CVE-2026-86132](https://cve.now/CVE-2026-86132.md): Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service (CVSS 8.2, WatchGuard Fireware OS)
- [CVE-2026-86128](https://cve.now/CVE-2026-86128.md): Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service (CVSS 8.2, WatchGuard Fireware OS)
- [CVE-2026-81433](https://cve.now/CVE-2026-81433.md): Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-103048](https://cve.now/CVE-2026-103048.md): Open Redirect in Special:Book (CVSS 6.1, The Wikimedia Foundation Mediawiki - Collection extension)
- [CVE-2026-103047](https://cve.now/CVE-2026-103047.md): XSS through i18n message in CentralAuth (CVSS 6.1, The Wikimedia Foundation Mediawiki - CentralAuth extension)
- [CVE-2026-103045](https://cve.now/CVE-2026-103045.md): XSS in Refreshed skin (CVSS 6.1, The Wikimedia Foundation Mediawiki - Refreshed skin)
- [CVE-2026-103043](https://cve.now/CVE-2026-103043.md): anchorme through 3.0.8 Regular Expression Denial of Service (CVSS 8.7, alexcorvi anchorme)
- [CVE-2026-103042](https://cve.now/CVE-2026-103042.md): LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set\_value (CVSS 8.7, ModelTC LightLLM)
- [CVE-2026-103041](https://cve.now/CVE-2026-103041.md): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service (CVSS 9.3, ModelTC LightLLM)
- [CVE-2026-103040](https://cve.now/CVE-2026-103040.md): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service (CVSS 9.3, ModelTC LightLLM)
- [CVE-2026-103044](https://cve.now/CVE-2026-103044.md): EasyTimeline should not serve image maps as application/xml (CVSS 9.8, The Wikimedia Foundation Mediawiki - EasyTimeline extension)
- [CVE-2026-102792](https://cve.now/CVE-2026-102792.md): Ziroom ZHOME A0101 set\_syslog command injection (CVSS 9.4, Ziroom ZHOME A0101)
- [CVE-2026-103046](https://cve.now/CVE-2026-103046.md): WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML (CVSS 6.1, The Wikimedia Foundation Mediawiki - WikiLambda Extension)
- [CVE-2026-102771](https://cve.now/CVE-2026-102771.md): Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine (CVSS 5.1, Naichen ThinkCMF)
- [CVE-2026-71189](https://cve.now/CVE-2026-71189.md): Toptech TMS7 and TopHAT Cross-site Scripting (CVSS 3.5, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-69662](https://cve.now/CVE-2026-69662.md): Toptech TMS7 and TopHAT Eval Injection (CVSS 3.7, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-71302](https://cve.now/CVE-2026-71302.md): Toptech TMS7 and TopHAT Session Fixation (CVSS 7.1, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-72507](https://cve.now/CVE-2026-72507.md): Toptech TMS7 and TopHAT SQL Injection (CVSS 9.0, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-68068](https://cve.now/CVE-2026-68068.md): Toptech TMS7 and TopHAT SQL Injection (CVSS 9.0, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-68954](https://cve.now/CVE-2026-68954.md): Toptech TMS7 and TopHAT SQL Injection (CVSS 9.0, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-63713](https://cve.now/CVE-2026-63713.md): Toptech TMS7 and TopHAT SQL Injection (CVSS 9.0, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-102621](https://cve.now/CVE-2026-102621.md): Freedesktop Poppler SplashClip.cc clipToPath integer overflow (CVSS 4.8, Freedesktop Poppler)
- [CVE-2026-74225](https://cve.now/CVE-2026-74225.md): U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6 (CVSS 7.1, u-boot)
- [CVE-2026-74222](https://cve.now/CVE-2026-74222.md): U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback (CVSS 8.8, u-boot)
- [CVE-2026-74221](https://cve.now/CVE-2026-74221.md): U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK (CVSS 8.8, u-boot)
- [CVE-2026-74220](https://cve.now/CVE-2026-74220.md): U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply (CVSS 8.8, u-boot)
- [CVE-2026-71974](https://cve.now/CVE-2026-71974.md): U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read (CVSS 4.3, u-boot)
- [CVE-2026-71973](https://cve.now/CVE-2026-71973.md): U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation (CVSS 5.2, u-boot)
- [CVE-2026-71972](https://cve.now/CVE-2026-71972.md): U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder (CVSS 6.0, u-boot)
- [CVE-2026-71971](https://cve.now/CVE-2026-71971.md): U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly (CVSS 8.8, u-boot)
- [CVE-2026-72510](https://cve.now/CVE-2026-72510.md): Toptech TMS7 and TopHAT SQL Injection (CVSS 9.0, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-70356](https://cve.now/CVE-2026-70356.md): Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type (CVSS 9.1, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-71379](https://cve.now/CVE-2026-71379.md): Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties (CVSS 10.0, Toptech Systems TMS7 · Toptech Systems TopHAT)
- [CVE-2026-91191](https://cve.now/CVE-2026-91191.md): Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature (CVSS 7.5, Lantronix G520 Series)
- [CVE-2026-84409](https://cve.now/CVE-2026-84409.md): Lantronix G520 Series Cellular Gateway Cross-site Scripting (CVSS 7.5, Lantronix G520 Series)
- [CVE-2026-102938](https://cve.now/CVE-2026-102938.md): virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection (CVSS 5.8, pypa virtualenv · virtualenv)
- [CVE-2026-102937](https://cve.now/CVE-2026-102937.md): virtualenv: Command injection via --prompt in activate.bat (batch activator) (CVSS 7.3, pypa virtualenv · virtualenv)
- [CVE-2026-93853](https://cve.now/CVE-2026-93853.md): Barman snapshot backup deletion trusts unverified backup catalog metadata (CVSS 7.2, EnterpriseDB Barman)
- [CVE-2026-102930](https://cve.now/CVE-2026-102930.md): virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use (CVSS 7.7, pypa virtualenv · virtualenv)
- [CVE-2026-102925](https://cve.now/CVE-2026-102925.md): virtualenv bash and fish activation scripts execute commands embedded in paths (CVSS 7.8, pypa virtualenv · virtualenv)
- [CVE-2026-81842](https://cve.now/CVE-2026-81842.md): Library panel can be moved into a folder without library panel create permission (CVSS 4.3, Grafana Enterprise · Grafana OSS)
- [CVE-2026-102904](https://cve.now/CVE-2026-102904.md): JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs (CVSS 5.4, jupyterlab)
- [CVE-2026-96587](https://cve.now/CVE-2026-96587.md): Use of Hard-coded Credentials in Viidure Dashcam Android Application (CVSS 10.0, Viidure Dashcam Android Application)
- [CVE-2026-94204](https://cve.now/CVE-2026-94204.md): Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application (CVSS 8.7, Viidure Dashcam Android Application)
- [CVE-2026-81841](https://cve.now/CVE-2026-81841.md): Paused shared dashboard access tokens still expose data source configuration (CVSS 5.3, Grafana Enterprise · Grafana OSS)
- [CVE-2026-102620](https://cve.now/CVE-2026-102620.md): Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow (CVSS 4.8, Freedesktop Poppler)
- [CVE-2026-102253](https://cve.now/CVE-2026-102253.md): iperf3 \< 3.22 UDP Receive Worker Infinite Loop DoS (CVSS 8.7, esnet iperf3)
- [CVE-2026-102879](https://cve.now/CVE-2026-102879.md): ClaraVerse through 0.3.1 SSRF Protection Bypass (CVSS 5.3, claraverse-space ClaraVerse)
- [CVE-2026-102878](https://cve.now/CVE-2026-102878.md): mcp-chrome-bridge through 1.0.31 CORS Origin Bypass (CVSS 8.6, hangwin mcp-chrome-bridge)
- [CVE-2026-102877](https://cve.now/CVE-2026-102877.md): Fider before 0.38.0 SSRF via DNS rebinding in webhook validation (CVSS 2.1, getfider fider)
- [CVE-2026-102876](https://cve.now/CVE-2026-102876.md): SurrealDB before 3.3.0 Cross-Tenant Access via Headers (CVSS 8.6, surrealdb)
- [CVE-2026-102875](https://cve.now/CVE-2026-102875.md): VLC media player before 3.0.24 Path Traversal via skins2 (CVSS 8.5, videolan vlc)
- [CVE-2026-53988](https://cve.now/CVE-2026-53988.md): Dockhand \< 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints (CVSS 9.2, Finsys dockhand)
- [CVE-2026-100299](https://cve.now/CVE-2026-100299.md): Use of Weak Credentials in Anjvision YSSD-RTMP-H5 (CVSS 6.8, Anjvision YSSD-RTMP-H5)
- [CVE-2026-100298](https://cve.now/CVE-2026-100298.md): Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5 (CVSS 8.8, Anjvision YSSD-RTMP-H5)
- [CVE-2026-100297](https://cve.now/CVE-2026-100297.md): Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5 (CVSS 5.3, Anjvision YSSD-RTMP-H5)
- [CVE-2026-100296](https://cve.now/CVE-2026-100296.md): Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5 (CVSS 8.1, Anjvision YSSD-RTMP-H5)
- [CVE-2026-102305](https://cve.now/CVE-2026-102305.md): UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafte (CVSS 5.4, Google Chrome)
- [CVE-2026-102314](https://cve.now/CVE-2026-102314.md): UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML p (CVSS 5.4, Google Chrome)
- [CVE-2026-102330](https://cve.now/CVE-2026-102330.md): Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer (CVSS 6.5, Google Chrome)
- [CVE-2026-102327](https://cve.now/CVE-2026-102327.md): Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the r (CVSS 7.5, Google Chrome)
- [CVE-2026-102310](https://cve.now/CVE-2026-102310.md): Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process (CVSS 6.5, Google Chrome)
- [CVE-2026-102320](https://cve.now/CVE-2026-102320.md): Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to (CVSS 6.5, Google Chrome)
- [CVE-2026-102321](https://cve.now/CVE-2026-102321.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-102302](https://cve.now/CVE-2026-102302.md): Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-102315](https://cve.now/CVE-2026-102315.md): Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the rend (CVSS 3.4, Google Chrome)
- [CVE-2026-102329](https://cve.now/CVE-2026-102329.md): Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privilege (CVSS 6.1, Google Chrome)
- [CVE-2026-102318](https://cve.now/CVE-2026-102318.md): Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a craft (CVSS 4.7, Google Chrome)
- [CVE-2026-102324](https://cve.now/CVE-2026-102324.md): Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-102319](https://cve.now/CVE-2026-102319.md): Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to (CVSS 3.4, Google Chrome)
- [CVE-2026-102301](https://cve.now/CVE-2026-102301.md): Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-102308](https://cve.now/CVE-2026-102308.md): Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary (CVSS 9.6, Google Chrome)
- [CVE-2026-102325](https://cve.now/CVE-2026-102325.md): Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2026-102309](https://cve.now/CVE-2026-102309.md): Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox (CVSS 9.6, Google Chrome)
- [CVE-2026-102328](https://cve.now/CVE-2026-102328.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-102304](https://cve.now/CVE-2026-102304.md): Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox (CVSS 9.6, Google Chrome)
- [CVE-2026-102316](https://cve.now/CVE-2026-102316.md): Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary (CVSS 9.6, Google Chrome)
- [CVE-2026-102326](https://cve.now/CVE-2026-102326.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-102300](https://cve.now/CVE-2026-102300.md): Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-102311](https://cve.now/CVE-2026-102311.md): Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the render (CVSS 3.4, Google Chrome)
- [CVE-2026-102303](https://cve.now/CVE-2026-102303.md): Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data vi (CVSS 4.3, Google Chrome)
- [CVE-2026-102323](https://cve.now/CVE-2026-102323.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-102307](https://cve.now/CVE-2026-102307.md): Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sa (CVSS 4.7, Google Chrome)
- [CVE-2026-102306](https://cve.now/CVE-2026-102306.md): Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside (CVSS 9.6, Google Chrome)
- [CVE-2026-102299](https://cve.now/CVE-2026-102299.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-102313](https://cve.now/CVE-2026-102313.md): Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the s (CVSS 4.7, Google Chrome)
- [CVE-2026-102312](https://cve.now/CVE-2026-102312.md): UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-102317](https://cve.now/CVE-2026-102317.md): Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute (CVSS 8.6, Google Chrome)
- [CVE-2026-102331](https://cve.now/CVE-2026-102331.md): Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary co (CVSS 9.6, Google Chrome)
- [CVE-2026-100295](https://cve.now/CVE-2026-100295.md): Active debug code in Anjvision YSSD-RTMP-H5 (CVSS 6.3, Anjvision YSSD-RTMP-H5)
- [CVE-2026-53989](https://cve.now/CVE-2026-53989.md): Dockhand \< 1.0.36 Open Redirect via OIDC Initiation Endpoint (CVSS 5.3, Finsys dockhand)
- [CVE-2026-102252](https://cve.now/CVE-2026-102252.md): Path Traversal in VMDK Extractor in OSV-SCALIBR (CVSS 6.9, Google OSV-SCALIBR)
- [CVE-2026-100294](https://cve.now/CVE-2026-100294.md): Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5 (CVSS 7.5, Anjvision YSSD-RTMP-H5)
- [CVE-2026-100293](https://cve.now/CVE-2026-100293.md): Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5 (CVSS 8.8, Anjvision YSSD-RTMP-H5)
- [CVE-2026-100292](https://cve.now/CVE-2026-100292.md): Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5 (CVSS 8.8, Anjvision YSSD-RTMP-H5)
- [CVE-2026-100291](https://cve.now/CVE-2026-100291.md): Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5 (CVSS 9.8, Anjvision YSSD-RTMP-H5)
- [CVE-2026-96274](https://cve.now/CVE-2026-96274.md): Uncaught exception in Baicells Nova 430H (CVSS 7.4, Baicells Nova 430H eNodeB)
- [CVE-2026-76738](https://cve.now/CVE-2026-76738.md): Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service (CVSS 2.7, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76737](https://cve.now/CVE-2026-76737.md): Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On (CVSS 3.0, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76736](https://cve.now/CVE-2026-76736.md): Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On (CVSS 3.3, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76735](https://cve.now/CVE-2026-76735.md): Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On (CVSS 4.1, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76734](https://cve.now/CVE-2026-76734.md): Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in HPE Networking Instant On (CVSS 4.8, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76733](https://cve.now/CVE-2026-76733.md): Authenticated Denial-of-Service Vulnerability in HPE Networking Instant On API Endpoint (CVSS 4.9, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76732](https://cve.now/CVE-2026-76732.md): Authenticated Local Privilege Escalation Vulnerability in a Daemon of HPE Networking Instant ON (CVSS 6.4, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76731](https://cve.now/CVE-2026-76731.md): Authentication Bypass in the Captive Portal of HPE Networking Instant On (CVSS 6.5, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76730](https://cve.now/CVE-2026-76730.md): Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs (CVSS 6.5, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76729](https://cve.now/CVE-2026-76729.md): Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint (CVSS 6.6, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76728](https://cve.now/CVE-2026-76728.md): Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs (CVSS 7.2, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76727](https://cve.now/CVE-2026-76727.md): Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON (CVSS 7.2, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76726](https://cve.now/CVE-2026-76726.md): Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint (CVSS 8.1, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76725](https://cve.now/CVE-2026-76725.md): Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs (CVSS 9.6, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76724](https://cve.now/CVE-2026-76724.md): Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol (CVSS 9.6, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76723](https://cve.now/CVE-2026-76723.md): Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS (CVSS 9.6, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76722](https://cve.now/CVE-2026-76722.md): Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs (CVSS 9.8, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-76721](https://cve.now/CVE-2026-76721.md): Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs (CVSS 9.8, Hewlett Packard Enterprise (HPE) Instant ON)
- [CVE-2026-61519](https://cve.now/CVE-2026-61519.md): Liberu CRM 0.9.1 \< 10.0.0 Broken Access Control via TeamPolicy::addTeamMember() (CVSS 8.7, Liberu Software Liberu CRM)
- [CVE-2026-102831](https://cve.now/CVE-2026-102831.md): JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard (CVSS 8.1, jupyterlab · notebook +2)
- [CVE-2026-102830](https://cve.now/CVE-2026-102830.md): JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) (CVSS 6.8, jupyterlab · jupyterlite-core)
- [CVE-2026-102829](https://cve.now/CVE-2026-102829.md): simple-git: \`VISUAL\` editor environment variable is omitted from unsafe editor detection (CVSS 9.2, steveukx git-js · @simple-git/argv-parser)
- [CVE-2026-102616](https://cve.now/CVE-2026-102616.md): risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection (CVSS 6.9, risesoft-y9 WorkFlow-Engine)
- [CVE-2026-102828](https://cve.now/CVE-2026-102828.md): simple-git unsafe-operation guard does not block trailer command configuration (CVSS 9.2, steveukx git-js · simple-git)
- [CVE-2026-102827](https://cve.now/CVE-2026-102827.md): simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -\> command execution (residual of CVE-2026-28291) (CVSS 8.1, steveukx git-js · simple-git)
- [CVE-2026-102826](https://cve.now/CVE-2026-102826.md): simple-git allows command execution through unblocked Git configuration includes (CVSS 8.1, steveukx git-js · simple-git)
- [CVE-2026-102825](https://cve.now/CVE-2026-102825.md): Russh: Configured server auth-attempt cap is not enforced in the USERAUTH\_REQUEST runtime path (CVSS 3.7, Eugeny russh · russh)
- [CVE-2026-102824](https://cve.now/CVE-2026-102824.md): Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange (CVSS 4.3, Eugeny russh · russh)
- [CVE-2026-102823](https://cve.now/CVE-2026-102823.md): russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened (CVSS 7.5, Eugeny russh · russh)
- [CVE-2026-102822](https://cve.now/CVE-2026-102822.md): russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic (CVSS 3.7, Eugeny russh · russh)
- [CVE-2026-102821](https://cve.now/CVE-2026-102821.md): Russh: Unbounded memory exhaustion via CHANNEL\_OPEN flood during a client-stalled rekey (CVSS 6.5, Eugeny russh · russh)
- [CVE-2026-102820](https://cve.now/CVE-2026-102820.md): pageant: Out-of-bounds read / oversized allocation in \`pageant\` MemoryMap::read via a malicious Pageant agent (Windows) (CVSS 6.2, Eugeny russh · rust pageant +1)
- [CVE-2026-84414](https://cve.now/CVE-2026-84414.md): IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service \[\] (CVSS 7.8, IBM i)
- [CVE-2026-102730](https://cve.now/CVE-2026-102730.md): Mounting an attacker-controlled NAND flash image (\`lx\_nand\_flash\_open()\`) triggers an unbounded out-of-bounds heap \*\*write\*\* in LevelX's NAN (CVSS 8.6, Eclipse Foundation eclipse-threadx/levelx)
- [CVE-2026-102729](https://cve.now/CVE-2026-102729.md): \`gx\_binres\_theme\_load()\` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with (CVSS 5.9, Eclipse Foundation GUIX)
- [CVE-2026-102727](https://cve.now/CVE-2026-102727.md): FTP Passive Data Connection Not Bound to the Authenticated Control Peer (CVSS 6.0, Eclipse Foundation NetX Duo)
- [CVE-2026-102639](https://cve.now/CVE-2026-102639.md): MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization (CVSS 7.1, MobilityDB)
- [CVE-2026-84421](https://cve.now/CVE-2026-84421.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-84422](https://cve.now/CVE-2026-84422.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.2, IBM Guardium Data Protection)
- [CVE-2026-102728](https://cve.now/CVE-2026-102728.md): Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is l (CVSS 7.5, Eclipse Foundation NetX Duo)
- [CVE-2026-84436](https://cve.now/CVE-2026-84436.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 9.1, IBM Guardium Data Protection)
- [CVE-2026-102726](https://cve.now/CVE-2026-102726.md): Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read (CVSS 6.0, Eclipse Foundation NetX Duo)
- [CVE-2026-84440](https://cve.now/CVE-2026-84440.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 7.5, IBM Guardium Data Protection)
- [CVE-2026-102725](https://cve.now/CVE-2026-102725.md): Out-of-bounds Read from Unvalidated MSRP Attribute List Length (CVSS 6.0, Eclipse Foundation NetX Duo)
- [CVE-2026-102724](https://cve.now/CVE-2026-102724.md): NULL Pointer Dereference When Evicting the Sole MSRP Attribute (CVSS 6.0, Eclipse Foundation NetX Duo)
- [CVE-2026-102723](https://cve.now/CVE-2026-102723.md): NULL Pointer Dereference on MSRP Attribute Table Exhaustion (CVSS 6.0, Eclipse Foundation NetX Duo)
- [CVE-2026-84842](https://cve.now/CVE-2026-84842.md): IBM Guardium Data Protection is affected by multiple vulnerabilities. (CVSS 8.1, IBM Guardium Data Protection)
- [CVE-2026-102722](https://cve.now/CVE-2026-102722.md): In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's \`227\` reply. (CVSS 6.9, Eclipse Foundation NetX Duo)
- [CVE-2026-102242](https://cve.now/CVE-2026-102242.md): Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases (CVSS 8.6, Google MCP Toolbox for Databases)
- [CVE-2026-102721](https://cve.now/CVE-2026-102721.md): A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. (CVSS 6.9, Eclipse Foundation NetX Duo)
- [CVE-2026-102720](https://cve.now/CVE-2026-102720.md): A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received (CVSS 5.3, Eclipse Foundation eclipse-threadx/netxduo)
- [CVE-2026-12345](https://cve.now/CVE-2026-12345.md): Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory (CVSS 5.9, Python Software Foundation CPython · libpython +2)
- [CVE-2026-102719](https://cve.now/CVE-2026-102719.md): Predictable DTLS HelloVerifyRequest Cookie in NetX Secure (CVSS 6.3, Eclipse Foundation netxduo)
- [CVE-2026-102718](https://cve.now/CVE-2026-102718.md): hey, \`\_nx\_snmp\_utility\_object\_id\_get\` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer (CVSS 8.7, Eclipse Foundation NetX Duo)
- [CVE-2026-102716](https://cve.now/CVE-2026-102716.md): An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser (CVSS 8.7, Eclipse Foundation eclipse-threadx/netxduo)
- [CVE-2026-102677](https://cve.now/CVE-2026-102677.md): Electron: Sandboxed preload code cache can be poisoned by a compromised renderer (CVSS 7.8, electron)
- [CVE-2026-102715](https://cve.now/CVE-2026-102715.md): mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet (CVSS 7.1, Eclipse Foundation eclipse-threadx/netxduo)
- [CVE-2026-102714](https://cve.now/CVE-2026-102714.md): \`\_nx\_icmpv6\_validate\_options()\` scans the option area with \`while (length \> 2)\` (\`common/src/nx\_icmpv6\_validate\_options.c:79\`). (CVSS 7.1, Eclipse Foundation NetX Duo)
- [CVE-2026-102713](https://cve.now/CVE-2026-102713.md): The TFTP server accepts a DATA datagram of any size. (CVSS 8.8, Eclipse Foundation NetX Duo)
- [CVE-2026-102712](https://cve.now/CVE-2026-102712.md): On the first DTLS ClientHello, the parser copies a device-claimed session\_id length and validates the ciphersuite-list length against the (CVSS 8.8, Eclipse Foundation NetX Duo)
- [CVE-2026-102711](https://cve.now/CVE-2026-102711.md): Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via \`\_txm\_module\_manager\_ (CVSS 5.6, Eclipse Foundation \`eclipse-threadx/threadx\`)
- [CVE-2026-102710](https://cve.now/CVE-2026-102710.md): Attacker model / Preconditions: a loaded \`TXM\_MODULE\_USER\_MODE | TXM\_MODULE\_MEMORY\_PROTECTION\` module issuing kernel dispatch calls, on a bu (CVSS 9.3, Eclipse Foundation eclipse-threadx/threadx)
- [CVE-2026-102709](https://cve.now/CVE-2026-102709.md): Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executi (CVSS 8.4, Eclipse Foundation ThreadX)
- [CVE-2026-102762](https://cve.now/CVE-2026-102762.md): The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. (CVSS 8.2, Eclipse Foundation NetX Duo)
- [CVE-2026-95305](https://cve.now/CVE-2026-95305.md): UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof (CVSS 4.8, Google Chrome)
- [CVE-2026-95364](https://cve.now/CVE-2026-95364.md): Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted (CVSS 5.4, Google Chrome)
- [CVE-2026-95340](https://cve.now/CVE-2026-95340.md): Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering (CVSS 4.3, Google Chrome)
- [CVE-2026-95328](https://cve.now/CVE-2026-95328.md): Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to ob (CVSS 6.5, Google Chrome)
- [CVE-2026-95316](https://cve.now/CVE-2026-95316.md): Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a loca (CVSS 2.9, Google Chrome)
- [CVE-2026-95296](https://cve.now/CVE-2026-95296.md): Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to o (CVSS 4.3, Google Chrome)
- [CVE-2026-95342](https://cve.now/CVE-2026-95342.md): Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML (CVSS 4.3, Google Chrome)
- [CVE-2026-95380](https://cve.now/CVE-2026-95380.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute (CVSS 8.8, Google Chrome)
- [CVE-2026-95288](https://cve.now/CVE-2026-95288.md): UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafte (CVSS 5.4, Google Chrome)
- [CVE-2026-95361](https://cve.now/CVE-2026-95361.md): Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web or (CVSS 4.3, Google Chrome)
- [CVE-2026-95309](https://cve.now/CVE-2026-95309.md): UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafte (CVSS 5.4, Google Chrome)
- [CVE-2026-95326](https://cve.now/CVE-2026-95326.md): Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass sy (CVSS 8.4, Google Chrome)
- [CVE-2026-95319](https://cve.now/CVE-2026-95319.md): Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-95368](https://cve.now/CVE-2026-95368.md): Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to poten (CVSS 4.3, Google Chrome)
- [CVE-2026-95385](https://cve.now/CVE-2026-95385.md): Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveragi (CVSS 6.5, Google Chrome)
- [CVE-2026-95367](https://cve.now/CVE-2026-95367.md): Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process (CVSS 5.3, Google Chrome)
- [CVE-2026-95279](https://cve.now/CVE-2026-95279.md): UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a c (CVSS 5.4, Google Chrome)
- [CVE-2026-95352](https://cve.now/CVE-2026-95352.md): Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypas (CVSS 5.4, Google Chrome)
- [CVE-2026-95292](https://cve.now/CVE-2026-95292.md): Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictio (CVSS 4.8, Google Chrome)
- [CVE-2026-95308](https://cve.now/CVE-2026-95308.md): Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to po (CVSS 3.4, Google Chrome)
- [CVE-2026-95334](https://cve.now/CVE-2026-95334.md): Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the rende (CVSS 8.3, Google Chrome)
- [CVE-2026-95327](https://cve.now/CVE-2026-95327.md): Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted (CVSS 6.5, Google Chrome)
- [CVE-2026-95278](https://cve.now/CVE-2026-95278.md): Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process (CVSS 8.4, Google Chrome)
- [CVE-2026-95285](https://cve.now/CVE-2026-95285.md): Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the ren (CVSS 8.4, Google Chrome)
- [CVE-2026-95307](https://cve.now/CVE-2026-95307.md): UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to sp (CVSS 5.4, Google Chrome)
- [CVE-2026-95333](https://cve.now/CVE-2026-95333.md): Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox vi (CVSS 8.1, Google Chrome)
- [CVE-2026-95358](https://cve.now/CVE-2026-95358.md): Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access res (CVSS 4.4, Google Chrome)
- [CVE-2026-95311](https://cve.now/CVE-2026-95311.md): Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentia (CVSS 9.6, Google Chrome)
- [CVE-2026-95347](https://cve.now/CVE-2026-95347.md): Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-95289](https://cve.now/CVE-2026-95289.md): Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain (CVSS 4.3, Google Chrome)
- [CVE-2026-95344](https://cve.now/CVE-2026-95344.md): Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site is (CVSS 8.0, Google Chrome)
- [CVE-2026-95312](https://cve.now/CVE-2026-95312.md): Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to (CVSS 3.1, Google Chrome)
- [CVE-2026-95332](https://cve.now/CVE-2026-95332.md): Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside (CVSS 4.7, Google Chrome)
- [CVE-2026-95323](https://cve.now/CVE-2026-95323.md): UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering t (CVSS 5.4, Google Chrome)
- [CVE-2026-95321](https://cve.now/CVE-2026-95321.md): UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a (CVSS 5.4, Google Chrome)
- [CVE-2026-95300](https://cve.now/CVE-2026-95300.md): Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass (CVSS 4.8, Google Chrome)
- [CVE-2026-95374](https://cve.now/CVE-2026-95374.md): Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a craft (CVSS 6.5, Google Chrome)
- [CVE-2026-95275](https://cve.now/CVE-2026-95275.md): Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy (CVSS 6.5, Google Chrome)
- [CVE-2026-95325](https://cve.now/CVE-2026-95325.md): Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-95290](https://cve.now/CVE-2026-95290.md): Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to b (CVSS 5.4, Google Chrome)
- [CVE-2026-95336](https://cve.now/CVE-2026-95336.md): Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to (CVSS 6.5, Google Chrome)
- [CVE-2026-95384](https://cve.now/CVE-2026-95384.md): Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive info (CVSS 5.3, Google Chrome)
- [CVE-2026-95354](https://cve.now/CVE-2026-95354.md): Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-95341](https://cve.now/CVE-2026-95341.md): Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proc (CVSS 8.3, Google Chrome)
- [CVE-2026-95363](https://cve.now/CVE-2026-95363.md): UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof (CVSS 5.4, Google Chrome)
- [CVE-2026-95353](https://cve.now/CVE-2026-95353.md): Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-95371](https://cve.now/CVE-2026-95371.md): Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer (CVSS 5.4, Google Chrome)
- [CVE-2026-95314](https://cve.now/CVE-2026-95314.md): Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to (CVSS 8.1, Google Chrome)
- [CVE-2026-95276](https://cve.now/CVE-2026-95276.md): Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-95295](https://cve.now/CVE-2026-95295.md): Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via phys (CVSS 4.6, Google Chrome)
- [CVE-2026-95360](https://cve.now/CVE-2026-95360.md): Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitiv (CVSS 5.3, Google Chrome)
- [CVE-2026-95303](https://cve.now/CVE-2026-95303.md): Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass sy (CVSS 6.5, Google Chrome)
- [CVE-2026-95370](https://cve.now/CVE-2026-95370.md): Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions v (CVSS 5.4, Google Chrome)
- [CVE-2026-95330](https://cve.now/CVE-2026-95330.md): Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restriction (CVSS 6.5, Google Chrome)
- [CVE-2026-95345](https://cve.now/CVE-2026-95345.md): Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-95317](https://cve.now/CVE-2026-95317.md): Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to o (CVSS 3.1, Google Chrome)
- [CVE-2026-95320](https://cve.now/CVE-2026-95320.md): Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce (CVSS 5.4, Google Chrome)
- [CVE-2026-95346](https://cve.now/CVE-2026-95346.md): UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted networ (CVSS 4.8, Google Chrome)
- [CVE-2026-95337](https://cve.now/CVE-2026-95337.md): UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineeri (CVSS 5.4, Google Chrome)
- [CVE-2026-95294](https://cve.now/CVE-2026-95294.md): UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI (CVSS 5.4, Google Chrome)
- [CVE-2026-95359](https://cve.now/CVE-2026-95359.md): Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the render (CVSS 3.4, Google Chrome)
- [CVE-2026-95376](https://cve.now/CVE-2026-95376.md): Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineeri (CVSS 8.0, Google Chrome)
- [CVE-2026-95369](https://cve.now/CVE-2026-95369.md): Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code (CVSS 8.8, Google Chrome)
- [CVE-2026-95362](https://cve.now/CVE-2026-95362.md): Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to by (CVSS 8.8, Google Chrome)
- [CVE-2026-95302](https://cve.now/CVE-2026-95302.md): Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin dat (CVSS 2.9, Google Chrome)
- [CVE-2026-95375](https://cve.now/CVE-2026-95375.md): Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer pro (CVSS 6.3, Google Chrome)
- [CVE-2026-95297](https://cve.now/CVE-2026-95297.md): Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-95331](https://cve.now/CVE-2026-95331.md): Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside (CVSS 9.6, Google Chrome)
- [CVE-2026-95381](https://cve.now/CVE-2026-95381.md): Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-95382](https://cve.now/CVE-2026-95382.md): Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process (CVSS 6.5, Google Chrome)
- [CVE-2026-95366](https://cve.now/CVE-2026-95366.md): Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process (CVSS 6.5, Google Chrome)
- [CVE-2026-95287](https://cve.now/CVE-2026-95287.md): Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce (CVSS 5.4, Google Chrome)
- [CVE-2026-95351](https://cve.now/CVE-2026-95351.md): Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execut (CVSS 8.3, Google Chrome)
- [CVE-2026-95299](https://cve.now/CVE-2026-95299.md): Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a (CVSS 9.6, Google Chrome)
- [CVE-2026-95306](https://cve.now/CVE-2026-95306.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-95304](https://cve.now/CVE-2026-95304.md): Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-95280](https://cve.now/CVE-2026-95280.md): Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 7.5, Google Chrome)
- [CVE-2026-95343](https://cve.now/CVE-2026-95343.md): Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-95365](https://cve.now/CVE-2026-95365.md): Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside t (CVSS 8.8, Google Chrome)
- [CVE-2026-95286](https://cve.now/CVE-2026-95286.md): Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-95318](https://cve.now/CVE-2026-95318.md): Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-95338](https://cve.now/CVE-2026-95338.md): Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-95335](https://cve.now/CVE-2026-95335.md): Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentia (CVSS 8.3, Google Chrome)
- [CVE-2026-95348](https://cve.now/CVE-2026-95348.md): Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-95277](https://cve.now/CVE-2026-95277.md): Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-95373](https://cve.now/CVE-2026-95373.md): Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitr (CVSS 8.8, Google Chrome)
- [CVE-2026-95282](https://cve.now/CVE-2026-95282.md): Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-95274](https://cve.now/CVE-2026-95274.md): Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proc (CVSS 8.3, Google Chrome)
- [CVE-2026-95293](https://cve.now/CVE-2026-95293.md): Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a cra (CVSS 4.7, Google Chrome)
- [CVE-2026-95283](https://cve.now/CVE-2026-95283.md): Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary cod (CVSS 9.6, Google Chrome)
- [CVE-2026-95324](https://cve.now/CVE-2026-95324.md): Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to (CVSS 3.4, Google Chrome)
- [CVE-2026-95372](https://cve.now/CVE-2026-95372.md): Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-95298](https://cve.now/CVE-2026-95298.md): Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the (CVSS 7.8, Google Chrome)
- [CVE-2026-95315](https://cve.now/CVE-2026-95315.md): Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sa (CVSS 7.8, Google Chrome)
- [CVE-2026-95355](https://cve.now/CVE-2026-95355.md): Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the re (CVSS 8.3, Google Chrome)
- [CVE-2026-95291](https://cve.now/CVE-2026-95291.md): UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar (CVSS 5.4, Google Chrome)
- [CVE-2026-95301](https://cve.now/CVE-2026-95301.md): Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce (CVSS 8.1, Google Chrome)
- [CVE-2026-95310](https://cve.now/CVE-2026-95310.md): Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox v (CVSS 9.6, Google Chrome)
- [CVE-2026-95356](https://cve.now/CVE-2026-95356.md): Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentiall (CVSS 9.6, Google Chrome)
- [CVE-2026-95329](https://cve.now/CVE-2026-95329.md): Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrar (CVSS 9.6, Google Chrome)
- [CVE-2026-95322](https://cve.now/CVE-2026-95322.md): Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer (CVSS 8.3, Google Chrome)
- [CVE-2026-95284](https://cve.now/CVE-2026-95284.md): Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t (CVSS 9.6, Google Chrome)
- [CVE-2026-95349](https://cve.now/CVE-2026-95349.md): Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary co (CVSS 9.6, Google Chrome)
- [CVE-2026-95313](https://cve.now/CVE-2026-95313.md): Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside (CVSS 9.6, Google Chrome)
- [CVE-2026-95281](https://cve.now/CVE-2026-95281.md): Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t (CVSS 9.6, Google Chrome)
- [CVE-2026-95339](https://cve.now/CVE-2026-95339.md): Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sand (CVSS 9.6, Google Chrome)
- [CVE-2026-95357](https://cve.now/CVE-2026-95357.md): Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary (CVSS 9.6, Google Chrome)
- [CVE-2026-95350](https://cve.now/CVE-2026-95350.md): Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t (CVSS 9.6, Google Chrome)
- [CVE-2026-102761](https://cve.now/CVE-2026-102761.md): NetX Duo's WebSocket client resets the unmasking cursor to the first \`NX\_PACKET\` each time it advances through a chained packet, while the l (CVSS 9.3, Eclipse Foundation NetX Duo)
- [CVE-2026-102760](https://cve.now/CVE-2026-102760.md): When NetX Secure is built with \`NX\_SECURE\_KEY\_CLEAR\`, every TLS record sent on an active session is wiped after it has been handed to TCP. (CVSS 8.3, Eclipse Foundation NetX Duo)
- [CVE-2026-102759](https://cve.now/CVE-2026-102759.md): NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. (CVSS 6.3, Eclipse Foundation NetX Duo)
- [CVE-2026-102758](https://cve.now/CVE-2026-102758.md): The \`\_nx\_secure\_x509\_asn1\_tlv\_block\_parse()\` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. (CVSS 7.5, Eclipse Foundation NetX Duo)
- [CVE-2026-102757](https://cve.now/CVE-2026-102757.md): An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, (CVSS 8.5, Eclipse Foundation ThreadX)
- [CVE-2026-102811](https://cve.now/CVE-2026-102811.md): Marmite through 0.4.2 Unauthenticated API Access via Development Server (CVSS 8.7, rochacbruno marmite)
- [CVE-2026-102810](https://cve.now/CVE-2026-102810.md): Marmite through 0.4.2 Path Traversal via Development Server (CVSS 8.7, rochacbruno marmite)
- [CVE-2026-102809](https://cve.now/CVE-2026-102809.md): PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command (CVSS 7.1, PX4-Autopilot)
- [CVE-2026-102808](https://cve.now/CVE-2026-102808.md): PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd\_stress (CVSS 7.1, PX4-Autopilot)
- [CVE-2026-102807](https://cve.now/CVE-2026-102807.md): OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket (CVSS 6.0, OpenClaw)
- [CVE-2026-102806](https://cve.now/CVE-2026-102806.md): OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines (CVSS 6.0, OpenClaw)
- [CVE-2026-102560](https://cve.now/CVE-2026-102560.md): Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth (CVSS 8.6, Red Hat Enterprise Linux)
- [CVE-2026-102559](https://cve.now/CVE-2026-102559.md): Libsoup: libsoup: heap buffer overflow during websocket client-frame masking (CVSS 8.6, Red Hat Enterprise Linux)
- [CVE-2026-102558](https://cve.now/CVE-2026-102558.md): Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth (CVSS 8.6, Red Hat Enterprise Linux)
- [CVE-2026-102555](https://cve.now/CVE-2026-102555.md): Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding (CVSS 8.2, Red Hat Enterprise Linux)
- [CVE-2026-102424](https://cve.now/CVE-2026-102424.md): Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms \< 2.4.3.4 (CVSS 8.9, balbooa.com Balbooa Forms extension for Joomla)
- [CVE-2026-102623](https://cve.now/CVE-2026-102623.md): Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume (CVSS 6.5, Red Hat OpenShift Virtualization)
- [CVE-2026-102425](https://cve.now/CVE-2026-102425.md): Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms \< 2.4.3.4 (CVSS 9.5, balbooa.com Balbooa Forms extension for Joomla)
- [CVE-2026-101126](https://cve.now/CVE-2026-101126.md): Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms \< 2.4.3.4 (CVSS 6.9, balbooa.com Balbooa Forms extension for Joomla)
- [CVE-2026-101112](https://cve.now/CVE-2026-101112.md): Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms \< 2.4.3.4 (CVSS 6.9, balbooa.com Balbooa Forms extension for Joomla)
- [CVE-2026-101127](https://cve.now/CVE-2026-101127.md): Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms \< 2.4.3.4 (CVSS 8.6, balbooa.com Balbooa Forms extension for Joomla)
- [CVE-2026-102676](https://cve.now/CVE-2026-102676.md): Electron: \<webview\> can enable Node.js integration in Web Workers despite embedder restrictions (CVSS 8.3, electron)
- [CVE-2026-102796](https://cve.now/CVE-2026-102796.md): Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters (CVSS 7.5, Wikimedia Foundation Mediawiki - UserPageViewTracker Extens…)
- [CVE-2026-102675](https://cve.now/CVE-2026-102675.md): Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled (CVSS 7.4, electron)
- [CVE-2026-100245](https://cve.now/CVE-2026-100245.md): Stored XSS on Wikibase Special:SetSiteLink via unescaped system message (CVSS 6.1, Wikimedia Foundation Mediawiki - Wikibase Extension)
- [CVE-2026-102674](https://cve.now/CVE-2026-102674.md): Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions (CVSS 8.2, electron)
- [CVE-2026-100244](https://cve.now/CVE-2026-100244.md): CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) (CVSS 7.5, Wikimedia Foundation Mediawiki - CentralAuth Extension)
- [CVE-2026-102697](https://cve.now/CVE-2026-102697.md): Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization (CVSS 8.5, ollama)
- [CVE-2026-90915](https://cve.now/CVE-2026-90915.md): Joomla! Core - \[20260905\] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.0, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-92226](https://cve.now/CVE-2026-92226.md): Joomla! Core - \[20260913\] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.0, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-92224](https://cve.now/CVE-2026-92224.md): Joomla! Core - \[20260911\] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-90907](https://cve.now/CVE-2026-90907.md): Joomla! Core - \[20260902\] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 6.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-100243](https://cve.now/CVE-2026-100243.md): Stored XSS in WikiSEO author and image properties on action=info (CVSS 6.1, Wikimedia Foundation Mediawiki - WikiSEO Extension)
- [CVE-2026-90914](https://cve.now/CVE-2026-90914.md): Joomla! Core - \[20260904\] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-92231](https://cve.now/CVE-2026-92231.md): Joomla! Core - \[20260915\] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.1, Joomla! Project Joomla! CMS · Joomla! Project Joomla! Fr… +1)
- [CVE-2026-100242](https://cve.now/CVE-2026-100242.md): DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) (CVSS 7.5, Wikimedia Foundation Mediawiki - DataTransfer Extension)
- [CVE-2026-90918](https://cve.now/CVE-2026-90918.md): Joomla! Core - \[20260908\] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 6.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-92222](https://cve.now/CVE-2026-92222.md): Joomla! Core - \[20260909\] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 8.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-102673](https://cve.now/CVE-2026-102673.md): Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab (CVSS 8.2, electron)
- [CVE-2026-92223](https://cve.now/CVE-2026-92223.md): Joomla! Core - \[20260910\] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.1, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-90917](https://cve.now/CVE-2026-90917.md): Joomla! Core - \[20260907\] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 6.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-92225](https://cve.now/CVE-2026-92225.md): Joomla! Core - \[20260912\] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-92227](https://cve.now/CVE-2026-92227.md): Joomla! Core - \[20260914\] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 8.2, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-92232](https://cve.now/CVE-2026-92232.md): Joomla! Core - \[20260916\] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.1, Joomla! Project Joomla! CMS · Joomla! Project Joomla! Fr… +1)
- [CVE-2026-90916](https://cve.now/CVE-2026-90916.md): Joomla! Core - \[20260906\] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.1, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-100241](https://cve.now/CVE-2026-100241.md): Private change tags exposed to anonymous users via revision-tags-change events (CVSS 7.5, Wikimedia Foundation Mediawiki - EventBus Extension)
- [CVE-2026-90913](https://cve.now/CVE-2026-90913.md): Joomla! Core - \[20260903\] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.0, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-90906](https://cve.now/CVE-2026-90906.md): Joomla! Core - \[20260901\] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9, Joomla! Project Joomla! CMS · joomla)
- [CVE-2026-100240](https://cve.now/CVE-2026-100240.md): TemplateSandbox does not check read permissions for the page being previewed (CVSS 9.1, Wikimedia Foundation Mediawiki - TemplateSandbox Extension)
- [CVE-2026-100238](https://cve.now/CVE-2026-100238.md): Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS (CVSS 6.1, Wikimedia Foundation Mediawiki - Flow Extension)
- [CVE-2026-102557](https://cve.now/CVE-2026-102557.md): Libsoup: libsoup: heap buffer overflow during websocket message reassembly (CVSS 8.6, Red Hat Enterprise Linux)
- [CVE-2026-102556](https://cve.now/CVE-2026-102556.md): Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion (CVSS 8.6, Red Hat Enterprise Linux)
- [CVE-2026-102635](https://cve.now/CVE-2026-102635.md): ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder (CVSS 6.3, ImageMagick)
- [CVE-2026-102634](https://cve.now/CVE-2026-102634.md): SGLang through 0.5.20 Denial of Service via Duplicate bootstrap\_room (CVSS 8.7, sgl-project sglang)
- [CVE-2026-102633](https://cve.now/CVE-2026-102633.md): libexpat 2.7.2 through 2.8.5 Integer Overflow in expat\_realloc (CVSS 8.2, libexpat)
- [CVE-2022-51019](https://cve.now/CVE-2022-51019.md): Akaunting before 2.1.31 OS Command Injection via app alias (CVSS 8.7, akaunting)
- [CVE-2026-97711](https://cve.now/CVE-2026-97711.md): Serialize JavaScript: Cross-site scripting (XSS) via unescaped \</script\> in serialized function bodies (CVSS 2.3, yahoo serialize-javascript · serialize-javascript)
- [CVE-2026-100289](https://cve.now/CVE-2026-100289.md): Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privile (CVSS 5.0, Devolutions Server)
- [CVE-2026-100288](https://cve.now/CVE-2026-100288.md): Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access (CVSS 7.2, Devolutions Server)
- [CVE-2026-92370](https://cve.now/CVE-2026-92370.md): Remote Session Access Control Bypass Leading to Remote Code Execution (CVSS 8.8, TeamViewer Full Client · TeamViewer Host)
- [CVE-2026-102630](https://cve.now/CVE-2026-102630.md): UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host (CVSS 2.3, unopim)
- [CVE-2026-92371](https://cve.now/CVE-2026-92371.md): Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording (CVSS 7.0, TeamViewer Full Client · TeamViewer Host)
- [CVE-2026-92368](https://cve.now/CVE-2026-92368.md): Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution (CVSS 7.8, TeamViewer Full Client · TeamViewer Host)
- [CVE-2026-92369](https://cve.now/CVE-2026-92369.md): Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation (CVSS 7.3, TeamViewer Full Client · TeamViewer Host)
- [CVE-2026-19743](https://cve.now/CVE-2026-19743.md): Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients (CVSS 7.8, TeamViewer Full Client · TeamViewer Host)
- [CVE-2026-100287](https://cve.now/CVE-2026-100287.md): Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user (CVSS 5.4, Devolutions Server)
- [CVE-2026-97689](https://cve.now/CVE-2026-97689.md): urllib3: HTTPResponse.stream()/read\_chunked() buffers an unbounded chunk-size line into memory (CVSS 8.9, urllib3)
- [CVE-2026-100286](https://cve.now/CVE-2026-100286.md): Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrativ (CVSS 6.5, Devolutions Server)
- [CVE-2026-84784](https://cve.now/CVE-2026-84784.md): QUIC: Unbounded RETIRE\_CONNECTION\_ID Backlog (CVSS 7.5, OpenSSL)
- [CVE-2026-84783](https://cve.now/CVE-2026-84783.md): Use-After-Free in X.509 Extension Cache Under Concurrent Use (CVSS 7.5, OpenSSL)
- [CVE-2026-84782](https://cve.now/CVE-2026-84782.md): DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVSS 8.2, OpenSSL)
- [CVE-2026-77696](https://cve.now/CVE-2026-77696.md): Timing Side-Channel in SM2 Signature Generation (CVSS 3.7, OpenSSL)
- [CVE-2026-75806](https://cve.now/CVE-2026-75806.md): Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (CVSS 5.3, OpenSSL)
- [CVE-2026-75805](https://cve.now/CVE-2026-75805.md): NULL Pointer Dereference in CMP Client Revocation Response Handling (CVSS 5.3, OpenSSL)
- [CVE-2026-75804](https://cve.now/CVE-2026-75804.md): QUIC Connection-Level Flow Control is Not Enforced for Streams (CVSS 5.3, OpenSSL)
- [CVE-2026-72897](https://cve.now/CVE-2026-72897.md): Out-of-Bounds Access After SSL\_set\_SSL\_CTX() During a Handshake (CVSS 7.5, OpenSSL)
- [CVE-2026-97688](https://cve.now/CVE-2026-97688.md): urllib3: Chunked Deflate streaming can enter an infinite loop (CVSS 6.9, urllib3)
- [CVE-2026-54875](https://cve.now/CVE-2026-54875.md): Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (CVSS 3.7, OpenSSL)
- [CVE-2026-54873](https://cve.now/CVE-2026-54873.md): QUIC STREAM Fragment Metadata DoS (CVSS 7.5, OpenSSL)
- [CVE-2026-54872](https://cve.now/CVE-2026-54872.md): Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (CVSS 3.7, OpenSSL)
- [CVE-2026-42772](https://cve.now/CVE-2026-42772.md): Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC (CVSS 5.3, OpenSSL)
- [CVE-2026-35191](https://cve.now/CVE-2026-35191.md): QUIC Unvalidated Amplification Credit may be Over Accounted (CVSS 3.7, OpenSSL)
- [CVE-2026-35189](https://cve.now/CVE-2026-35189.md): Excessive Memory Allocation in Relative CRLDP Processing (CVSS 5.3, OpenSSL)
- [CVE-2026-97687](https://cve.now/CVE-2026-97687.md): urllib3: HTTPS proxy TLS configuration may be ignored or overridden (CVSS 7.6, urllib3)
- [CVE-2026-93332](https://cve.now/CVE-2026-93332.md): Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged us (CVSS 5.4, Devolutions Server)
- [CVE-2026-102601](https://cve.now/CVE-2026-102601.md): Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter (CVSS 3.5, thephpleague flysystem · league/flysystem)
- [CVE-2026-93330](https://cve.now/CVE-2026-93330.md): Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to byp (CVSS 4.3, Devolutions Server)
- [CVE-2026-102600](https://cve.now/CVE-2026-102600.md): Socket.IO: Prototype Pollution via Unsafe Client Session Lookup (CVSS 7.5, socketio socket.io · @socket.io cluster-engine +1)
- [CVE-2026-102598](https://cve.now/CVE-2026-102598.md): Werkzeug safe\_join() allows Windows special device names (CVSS 6.3, pallets werkzeug · werkzeug)
- [CVE-2023-54400](https://cve.now/CVE-2023-54400.md): Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname (CVSS 9.3, Fumasoft Fumeng Cloud)
- [CVE-2026-100308](https://cve.now/CVE-2026-100308.md): GluonTS arbitrary command execution during model deserialization (CVSS 7.8, AWS gluonts)
- [CVE-2026-68911](https://cve.now/CVE-2026-68911.md): Nicotine+: Decompression of peer messages can exhaust available memory (CVSS 8.7, nicotine-plus)
- [CVE-2026-63209](https://cve.now/CVE-2026-63209.md): Integer Overflow or Wraparound and Out-of-bounds Write in compress (CVSS 7.5, klauspost compress · github.com/klauspost/compress)
- [CVE-2015-20122](https://cve.now/CVE-2015-20122.md): Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp (CVSS 8.7, Yonyou A6 OA)
- [CVE-2026-86035](https://cve.now/CVE-2026-86035.md): Weblate: Mercurial argument injection via repository filenames allows authenticated command execution (CVSS 8.5, WeblateOrg weblate)
- [CVE-2026-49243](https://cve.now/CVE-2026-49243.md): Webmin: Reflected XSS in the Configuration module (CVSS 9.6, webmin)
- [CVE-2026-102491](https://cve.now/CVE-2026-102491.md): mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection (CVSS 6.9, mahonelau kykms)
- [CVE-2026-22094](https://cve.now/CVE-2026-22094.md): Weak root password in EVbee DC 80 (CVSS 9.3, EVbee DC)
- [CVE-2026-22101](https://cve.now/CVE-2026-22101.md): Sensitive information leak through hidden menu (CVSS 5.1, EVbee DC-80)
- [CVE-2026-102570](https://cve.now/CVE-2026-102570.md): ClipBucket v5 through 5.5.3-#197 SQL Injection via language\_id Parameter (CVSS 7.0, MacWarrior clipbucket-v5)
- [CVE-2026-102569](https://cve.now/CVE-2026-102569.md): ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter (CVSS 7.0, MacWarrior clipbucket-v5)
- [CVE-2026-102568](https://cve.now/CVE-2026-102568.md): Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py (CVSS 6.8, pardus-parental-control)
- [CVE-2026-102567](https://cve.now/CVE-2026-102567.md): CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization (CVSS 6.9, OpenNMT CTranslate2)
- [CVE-2026-102566](https://cve.now/CVE-2026-102566.md): CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin (CVSS 8.5, OpenNMT CTranslate2)
- [CVE-2025-33207](https://cve.now/CVE-2025-33207.md): NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control (CVSS 6.8, NVIDIA BlueField GA · NVIDIA BlueField LTS23 +5)
- [CVE-2026-102371](https://cve.now/CVE-2026-102371.md): wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments (CVSS 5.7, Canonical Ubuntu Pro for WSL)
- [CVE-2026-65102](https://cve.now/CVE-2026-65102.md): NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YA (CVSS 7.8, NVIDIA DeepStream)
- [CVE-2026-97395](https://cve.now/CVE-2026-97395.md): Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials (CVSS 8.1, Apache Software Foundation Apache Polaris)
- [CVE-2026-86450](https://cve.now/CVE-2026-86450.md): Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal (CVSS 7.5, Parla Auto Automotive Trading Limited Company DetaWix Mobil…)
- [CVE-2026-102521](https://cve.now/CVE-2026-102521.md): lib0 \`readFromDataView\` out-of-bounds read (CVSS 8.6, dmonad lib0)
- [CVE-2026-71897](https://cve.now/CVE-2026-71897.md): Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints (CVSS 4.3, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-102360](https://cve.now/CVE-2026-102360.md): lib0 \`readUint8Array\` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory (CVSS 8.6, dmonad lib0)
- [CVE-2026-71898](https://cve.now/CVE-2026-71898.md): Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions (CVSS 4.3, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-71899](https://cve.now/CVE-2026-71899.md): Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure (CVSS 6.5, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-78214](https://cve.now/CVE-2026-78214.md): Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths (CVSS 5.3, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-81569](https://cve.now/CVE-2026-81569.md): Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution (CVSS 4.3, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-4034](https://cve.now/CVE-2026-4034.md): TIBCO Administrator Injection Vulnerability (CVSS 8.7, Tibco Administrator)
- [CVE-2026-82804](https://cve.now/CVE-2026-82804.md): Apache DolphinScheduler: Command Injection in the Alert Script Plugin (CVSS 8.8, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-76875](https://cve.now/CVE-2026-76875.md): PyPy pyexpat ExternalEntityParserCreate Use-After-Free (CVSS 6.3, PyPy)
- [CVE-2026-100832](https://cve.now/CVE-2026-100832.md): Use-after-free in the Graphics: Canvas2D component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100831](https://cve.now/CVE-2026-100831.md): Use-after-free in the DOM: UI Events & Focus Handling component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100830](https://cve.now/CVE-2026-100830.md): Mitigation bypass in the DOM: Navigation component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100829](https://cve.now/CVE-2026-100829.md): Mitigation bypass in the DOM: Security component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100828](https://cve.now/CVE-2026-100828.md): Mitigation bypass in the Bookmarks & History component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100826](https://cve.now/CVE-2026-100826.md): Denial-of-service in the Storage: StorageManager component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100825](https://cve.now/CVE-2026-100825.md): Use-after-free in the JavaScript Engine: JIT component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100824](https://cve.now/CVE-2026-100824.md): Privilege escalation in the Places component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100823](https://cve.now/CVE-2026-100823.md): Spoofing issue in the Downloads component in Firefox for Android (CVSS 5.4, Mozilla Firefox)
- [CVE-2026-100822](https://cve.now/CVE-2026-100822.md): Spoofing issue in the Networking: HTTP component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100821](https://cve.now/CVE-2026-100821.md): Site isolation issue in the Panning and Zooming component (CVSS 4.7, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100820](https://cve.now/CVE-2026-100820.md): Privilege escalation in the Address Bar component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100819](https://cve.now/CVE-2026-100819.md): Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100818](https://cve.now/CVE-2026-100818.md): Sandbox escape due to use-after-free in the Widget: Gtk component (CVSS 9.6, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100817](https://cve.now/CVE-2026-100817.md): Other issue in the JavaScript: WebAssembly component (CVSS 5.4, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100816](https://cve.now/CVE-2026-100816.md): Site isolation issue in the DOM: Networking component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100815](https://cve.now/CVE-2026-100815.md): Use-after-free in the CSS Parsing and Computation component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100814](https://cve.now/CVE-2026-100814.md): Incorrect boundary conditions in the JavaScript Engine: JIT component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100813](https://cve.now/CVE-2026-100813.md): Invalid pointer in the JavaScript Engine: JIT component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100812](https://cve.now/CVE-2026-100812.md): Denial-of-service in the Graphics component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100811](https://cve.now/CVE-2026-100811.md): Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVSS 9.6, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100810](https://cve.now/CVE-2026-100810.md): Other issue in the DevTools component (CVSS 9.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100809](https://cve.now/CVE-2026-100809.md): Same-origin policy bypass in the DevTools component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100808](https://cve.now/CVE-2026-100808.md): Mitigation bypass in the DOM: Service Workers component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100807](https://cve.now/CVE-2026-100807.md): Privilege escalation in the DOM: Service Workers component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100806](https://cve.now/CVE-2026-100806.md): Uninitialized memory in the Graphics: WebGPU component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100805](https://cve.now/CVE-2026-100805.md): Race condition, use-after-free in the Audio/Video component (CVSS 7.5, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100804](https://cve.now/CVE-2026-100804.md): Sandbox escape due to use-after-free in the Preferences: Backend component (CVSS 9.6, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100803](https://cve.now/CVE-2026-100803.md): Same-origin policy bypass in the WebExtensions component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100802](https://cve.now/CVE-2026-100802.md): Uninitialized memory in the Graphics: WebGPU component (CVSS 4.3, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100801](https://cve.now/CVE-2026-100801.md): Privilege escalation in the DLL Services component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100800](https://cve.now/CVE-2026-100800.md): Sandbox escape due to use-after-free in the Disability Access APIs component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100799](https://cve.now/CVE-2026-100799.md): Uninitialized memory in the Graphics: WebGPU component (CVSS 4.3, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100798](https://cve.now/CVE-2026-100798.md): Cryptography misuse in Storage: Quota Manager component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100797](https://cve.now/CVE-2026-100797.md): Privilege escalation due to use-after-free in the Graphics: WebRender component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100796](https://cve.now/CVE-2026-100796.md): Use-after-free in the JavaScript: WebAssembly component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100795](https://cve.now/CVE-2026-100795.md): Denial-of-service in the Networking component (CVSS 6.5, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-96869](https://cve.now/CVE-2026-96869.md): Information disclosure in the Networking component (CVSS 4.3, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100794](https://cve.now/CVE-2026-100794.md): Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVSS 9.6, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100793](https://cve.now/CVE-2026-100793.md): JIT miscompilation in the JavaScript Engine component (CVSS 6.5, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100792](https://cve.now/CVE-2026-100792.md): JIT miscompilation in the JavaScript: WebAssembly component (CVSS 7.1, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100791](https://cve.now/CVE-2026-100791.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100790](https://cve.now/CVE-2026-100790.md): Use-after-free in the XSLT component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100789](https://cve.now/CVE-2026-100789.md): Use-after-free in the Graphics: Canvas2D component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100788](https://cve.now/CVE-2026-100788.md): Invalid pointer in the JavaScript: WebAssembly component (CVSS 9.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100787](https://cve.now/CVE-2026-100787.md): Sandbox escape in the XUL component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100786](https://cve.now/CVE-2026-100786.md): Sandbox escape due to use-after-free in the Graphics component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100785](https://cve.now/CVE-2026-100785.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100784](https://cve.now/CVE-2026-100784.md): Use-after-free in the Layout: Text and Fonts component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100783](https://cve.now/CVE-2026-100783.md): Uninitialized memory in the Audio/Video component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100782](https://cve.now/CVE-2026-100782.md): Privilege escalation due to incorrect boundary conditions in the Graphics component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100781](https://cve.now/CVE-2026-100781.md): Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100780](https://cve.now/CVE-2026-100780.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100779](https://cve.now/CVE-2026-100779.md): Use-after-free in the XSLT component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100778](https://cve.now/CVE-2026-100778.md): Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100777](https://cve.now/CVE-2026-100777.md): Use-after-free in the Graphics: Canvas2D component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100776](https://cve.now/CVE-2026-100776.md): Use-after-free in the JavaScript: WebAssembly component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100775](https://cve.now/CVE-2026-100775.md): Sandbox escape in the Graphics component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100774](https://cve.now/CVE-2026-100774.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100773](https://cve.now/CVE-2026-100773.md): Use-after-free in the Storage: IndexedDB component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100772](https://cve.now/CVE-2026-100772.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100771](https://cve.now/CVE-2026-100771.md): Undefined behavior in the DOM: Streams component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100770](https://cve.now/CVE-2026-100770.md): Sandbox escape due to use-after-free in the DOM: Content Processes component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100769](https://cve.now/CVE-2026-100769.md): Use-after-free in the JavaScript: WebAssembly component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100768](https://cve.now/CVE-2026-100768.md): Use-after-free in the Graphics: WebGPU component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100767](https://cve.now/CVE-2026-100767.md): Use-after-free in the Networking: Cache component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100766](https://cve.now/CVE-2026-100766.md): Information disclosure in the Networking: JAR component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100765](https://cve.now/CVE-2026-100765.md): Use-after-free in the JavaScript: WebAssembly component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100764](https://cve.now/CVE-2026-100764.md): Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100763](https://cve.now/CVE-2026-100763.md): Incorrect boundary conditions in the Graphics: WebGPU component (CVSS 9.1, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100762](https://cve.now/CVE-2026-100762.md): Sandbox escape due to use-after-free in the DOM: Content Processes component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100761](https://cve.now/CVE-2026-100761.md): Privilege escalation due to use-after-free in the Graphics: WebGPU component (CVSS 8.8, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2026-100760](https://cve.now/CVE-2026-100760.md): Sandbox escape in the Security: Process Sandboxing component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100759](https://cve.now/CVE-2026-100759.md): Uninitialized memory in the Storage: Quota Manager component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100758](https://cve.now/CVE-2026-100758.md): Sandbox escape in the DOM: Navigation component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100757](https://cve.now/CVE-2026-100757.md): Use-after-free in the Widget component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-100756](https://cve.now/CVE-2026-100756.md): Incorrect boundary conditions in the Audio/Video: Playback component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-76114](https://cve.now/CVE-2026-76114.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information v (CVSS 5.9, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-82973](https://cve.now/CVE-2026-82973.md): Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox (CVSS 9.4, psyb0t docker-mailbox)
- [CVE-2026-7192](https://cve.now/CVE-2026-7192.md): Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment (CVSS 9.3, Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi Rout…)
- [CVE-2026-7193](https://cve.now/CVE-2026-7193.md): Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment (CVSS 8.6, Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi Rout…)
- [CVE-2026-102437](https://cve.now/CVE-2026-102437.md): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix (CVSS 7.8, esengine DeepSeek-Reasonix)
- [CVE-2026-73599](https://cve.now/CVE-2026-73599.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirec (CVSS 5.4, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-101271](https://cve.now/CVE-2026-101271.md): OAuth credentials not disabled when application is disabled (CVSS 2.1, pretix)
- [CVE-2026-98164](https://cve.now/CVE-2026-98164.md): KVM: x86/mmu: Check write tracking in all address spaces (CVSS 7.1, Linux)
- [CVE-2026-101270](https://cve.now/CVE-2026-101270.md): HTML injection (CVSS 2.1, pretix)
- [CVE-2026-101269](https://cve.now/CVE-2026-101269.md): Incorrect session validation for API-uploaded files (CVSS 2.3, pretix)
- [CVE-2026-101268](https://cve.now/CVE-2026-101268.md): Customer session fixation (CVSS 1.7, pretix)
- [CVE-2026-73598](https://cve.now/CVE-2026-73598.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Res (CVSS 7.8, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-101267](https://cve.now/CVE-2026-101267.md): Revenue information leak (CVSS 2.7, pretix)
- [CVE-2026-73597](https://cve.now/CVE-2026-73597.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. (CVSS 6.5, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-101266](https://cve.now/CVE-2026-101266.md): Checkout validation bypass (CVSS 1.3, pretix)
- [CVE-2026-73596](https://cve.now/CVE-2026-73596.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure De (CVSS 3.8, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-87748](https://cve.now/CVE-2026-87748.md): Privilege Escalation via Account Takeover in Interprobe's Qorela DC (CVSS 8.8, Interprobe Information Technologies Qorela DC)
- [CVE-2026-102507](https://cve.now/CVE-2026-102507.md): Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC (CVSS 6.8, BishopFox sliver)
- [CVE-2026-66083](https://cve.now/CVE-2026-66083.md): Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource (CVSS 6.5, Apache Software Foundation Apache DolphinScheduler)
- [CVE-2026-41875](https://cve.now/CVE-2026-41875.md): Cross-Site Request Forgery in admin panel of Quick.Cart (CVSS 6.9, OpenSolution Quick.Cart)
- [CVE-2026-73595](https://cve.now/CVE-2026-73595.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without (CVSS 4.7, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-102497](https://cve.now/CVE-2026-102497.md): Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker (CVSS 7.5, Apache Software Foundation Apache XMLSchema)
- [CVE-2026-102496](https://cve.now/CVE-2026-102496.md): Apache XMLSchema: Denial of service through deeply nested schema structures (CVSS 7.5, Apache Software Foundation Apache XMLSchema)
- [CVE-2026-102495](https://cve.now/CVE-2026-102495.md): Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes (CVSS 7.5, Apache Software Foundation Apache XMLSchema)
- [CVE-2026-73594](https://cve.now/CVE-2026-73594.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Val (CVSS 6.4, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-85520](https://cve.now/CVE-2026-85520.md): Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module (CVSS 9.3, MyPresta Google Merchant Center Feed)
- [CVE-2026-73593](https://cve.now/CVE-2026-73593.md): Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. (CVSS 3.0, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2026-95520](https://cve.now/CVE-2026-95520.md): Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages (CVSS 7.1, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-95509](https://cve.now/CVE-2026-95509.md): Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs (CVSS 8.8, Qt for MCUs)
- [CVE-2026-19547](https://cve.now/CVE-2026-19547.md): Local Privilege Escalation in Ghostscript for Windows (CVSS 7.0, Artifex Software Ghostscript)
- [CVE-2026-76720](https://cve.now/CVE-2026-76720.md): HPE OneView - URL Redirect vulnerability (CVSS 4.3, Hewlett Packard Enterprise HPE OneView)
- [CVE-2026-15390](https://cve.now/CVE-2026-15390.md): Out-of-bounds write in Das U-Boot (CVSS 9.0, DENX Software Engineering Das U-Boot)
- [CVE-2026-76719](https://cve.now/CVE-2026-76719.md): HPE OneView - Cross-site scripting vulnerability (CVSS 8.2, Hewlett Packard Enterprise HPE OneView)
- [CVE-2026-86843](https://cve.now/CVE-2026-86843.md): Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag (CVSS 6.3, Apache Software Foundation Apache Airflow Teradata provider)
- [CVE-2026-81930](https://cve.now/CVE-2026-81930.md): Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain (CVSS 6.3, Apache Software Foundation Apache Airflow Snowflake provide…)
- [CVE-2026-81862](https://cve.now/CVE-2026-81862.md): Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs (CVSS 6.5, Apache Software Foundation Apache Airflow Teradata provider)
- [CVE-2026-81914](https://cve.now/CVE-2026-81914.md): Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names (CVSS 4.3, Apache Software Foundation Apache Airflow Google provider ·…)
- [CVE-2026-76718](https://cve.now/CVE-2026-76718.md): HPE OneView - Cross-site scripting vulnerability (CVSS 8.2, Hewlett Packard Enterprise HPE OneView)
- [CVE-2026-11796](https://cve.now/CVE-2026-11796.md): Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleR (CVSS 5.1, Hitachi Energy Asset Suite)
- [CVE-2026-7395](https://cve.now/CVE-2026-7395.md): Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to (CVSS 8.5, Hitachi Energy Asset Suite)
- [CVE-2026-4523](https://cve.now/CVE-2026-4523.md): Missing Authorization in GitLab (CVSS 3.7, GitLab)
- [CVE-2026-8937](https://cve.now/CVE-2026-8937.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-10518](https://cve.now/CVE-2026-10518.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-84739](https://cve.now/CVE-2026-84739.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-8067](https://cve.now/CVE-2026-8067.md): An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the (CVSS 6.5, Hitachi Energy RTU500 series CMU firmware)
- [CVE-2026-95391](https://cve.now/CVE-2026-95391.md): Use After Free in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-95389](https://cve.now/CVE-2026-95389.md): Heap-based Buffer Overflow in Wireshark (CVSS 8.1, Wireshark Foundation Wireshark)
- [CVE-2026-95386](https://cve.now/CVE-2026-95386.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-95390](https://cve.now/CVE-2026-95390.md): NULL Pointer Dereference in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-95395](https://cve.now/CVE-2026-95395.md): Missing Release of Memory after Effective Lifetime in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-95387](https://cve.now/CVE-2026-95387.md): Heap-based Buffer Overflow in Wireshark (CVSS 8.1, Wireshark Foundation Wireshark)
- [CVE-2026-95394](https://cve.now/CVE-2026-95394.md): Unchecked Input for Loop Condition in Wireshark (CVSS 4.7, Wireshark Foundation Wireshark)
- [CVE-2026-95393](https://cve.now/CVE-2026-95393.md): Heap-based Buffer Overflow in Wireshark (CVSS 4.7, Wireshark Foundation Wireshark)
- [CVE-2026-95392](https://cve.now/CVE-2026-95392.md): Buffer Over-read in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-95388](https://cve.now/CVE-2026-95388.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96422](https://cve.now/CVE-2026-96422.md): Reachable Assertion in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96421](https://cve.now/CVE-2026-96421.md): Improperly Controlled Sequential Memory Allocation in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96417](https://cve.now/CVE-2026-96417.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96418](https://cve.now/CVE-2026-96418.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96419](https://cve.now/CVE-2026-96419.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96420](https://cve.now/CVE-2026-96420.md): Buffer Over-read in Wireshark (CVSS 4.7, Wireshark Foundation Wireshark)
- [CVE-2026-96423](https://cve.now/CVE-2026-96423.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96416](https://cve.now/CVE-2026-96416.md): Heap-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-96415](https://cve.now/CVE-2026-96415.md): Stack-based Buffer Overflow in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-8066](https://cve.now/CVE-2026-8066.md): A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated (CVSS 9.1, Hitachi Energy RTU500 series CMU firmware)
- [CVE-2026-102474](https://cve.now/CVE-2026-102474.md): Dash: dash: heap out-of-bounds write in conv\_escape via undersized unicode escape reservation (CVSS 4.0, Red Hat Enterprise Linux)
- [CVE-2026-102473](https://cve.now/CVE-2026-102473.md): Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-8065](https://cve.now/CVE-2026-8065.md): An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticat (CVSS 9.1, Hitachi Energy RTU500 series CMU firmware)
- [CVE-2026-96440](https://cve.now/CVE-2026-96440.md): Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） (CVSS 7.1, Flowring Technology Agentflow)
- [CVE-2026-92142](https://cve.now/CVE-2026-92142.md): Apache Karaf: Authorization bypass in JMX MBean lifecycle operations (CVSS 8.8, Apache Software Foundation Apache Karaf)
- [CVE-2026-91085](https://cve.now/CVE-2026-91085.md): Apache Karaf: config:install missing ACL entry allows privilege escalation to admin (CVSS 6.3, Apache Software Foundation Apache Karaf)
- [CVE-2026-96431](https://cve.now/CVE-2026-96431.md): Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type (CVSS 9.3, Flowring Technology Agentflow)
- [CVE-2026-91048](https://cve.now/CVE-2026-91048.md): Apache Karaf: Missing authorization on the jdbc:\* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create (CVSS 9.8, Apache Software Foundation Apache Karaf)
- [CVE-2026-91012](https://cve.now/CVE-2026-91012.md): Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation (CVSS 9.8, Apache Software Foundation Apache Karaf)
- [CVE-2026-96430](https://cve.now/CVE-2026-96430.md): Flowring Agentflow 4.0 - Exposed Dangerous Method or Function (CVSS 8.7, Flowring Technology Agentflow)
- [CVE-2026-96429](https://cve.now/CVE-2026-96429.md): Flowring Agentflow 4.0 - SQL Injection (CVSS 9.3, Flowring Technology Agentflow)
- [CVE-2026-96428](https://cve.now/CVE-2026-96428.md): Flowring Agentflow 4.0 - SQL Injection (CVSS 9.3, Flowring Technology Agentflow)
- [CVE-2026-101169](https://cve.now/CVE-2026-101169.md): In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafte (CVSS 8.7, Octopus Deploy Octopus Server)
- [CVE-2026-84154](https://cve.now/CVE-2026-84154.md): Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x (CVSS 9.9, Dassault Systèmes GEOVIA Geospatial Data Manager)
- [CVE-2026-86158](https://cve.now/CVE-2026-86158.md): Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere (CVSS 7.7, Progress Software Progress® Telerik® Fiddler® Everywhere)
- [CVE-2026-86157](https://cve.now/CVE-2026-86157.md): Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere (CVSS 5.6, Progress Software Progress® Telerik® Fiddler® Everywhere)
- [CVE-2026-102293](https://cve.now/CVE-2026-102293.md): realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization (CVSS 6.9, realjerrytang tacomall)
- [CVE-2026-102292](https://cve.now/CVE-2026-102292.md): coolbeans1212 MateisHomePage-Website users.php cross site scripting (CVSS 5.3, coolbeans1212 MateisHomePage-Website)
- [CVE-2026-102290](https://cve.now/CVE-2026-102290.md): CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting (CVSS 5.1, CodeCanyon Rocket LMS)
- [CVE-2026-102264](https://cve.now/CVE-2026-102264.md): mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting (CVSS 5.1, mwasikz robo-cafe-rms)
- [CVE-2026-102263](https://cve.now/CVE-2026-102263.md): mwasikz robo-cafe-rms manage-food.php unrestricted upload (CVSS 5.1, mwasikz robo-cafe-rms)
- [CVE-2026-102261](https://cve.now/CVE-2026-102261.md): owen2345 Camaleon CMS Media Crop media\_controller.rb crop authorization (CVSS 5.3, owen2345 Camaleon CMS)
- [CVE-2026-102422](https://cve.now/CVE-2026-102422.md): shell-quote \`quote()\` command injection via a line terminator in a token after a \`{ comment }\` token (CVSS 8.1, shell-quote)
- [CVE-2026-102249](https://cve.now/CVE-2026-102249.md): REBUILD file-editor-save authorization (CVSS 6.9, REBUILD)
- [CVE-2026-97029](https://cve.now/CVE-2026-97029.md): Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group (CVSS 5.7, Red Hat Enterprise Linux)
- [CVE-2026-102414](https://cve.now/CVE-2026-102414.md): pbkdf2 rehashes long passwords on every iteration, enabling denial of service (CVSS 6.3, browserify pbkdf2 · pbkdf2)
- [CVE-2026-102248](https://cve.now/CVE-2026-102248.md): Rebuild Login Endpoint login improper authentication (CVSS 6.9, Rebuild)
- [CVE-2026-97024](https://cve.now/CVE-2026-97024.md): Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-102247](https://cve.now/CVE-2026-102247.md): FastAdmin Database Management database.php unnecessary privileges (CVSS 8.5, FastAdmin)
- [CVE-2026-102245](https://cve.now/CVE-2026-102245.md): MODSetter SurfSense circleback Endpoint circleback\_webhook\_route.py missing authentication (CVSS 6.9, MODSetter SurfSense)
- [CVE-2026-102244](https://cve.now/CVE-2026-102244.md): MODSetter SurfSense Document Export Feature editor\_routes.py server-side request forgery (CVSS 5.3, MODSetter SurfSense)
- [CVE-2026-102243](https://cve.now/CVE-2026-102243.md): MODSetter SurfSense MCP Connector Integration test command injection (CVSS 5.3, MODSetter SurfSense)
- [CVE-2026-97685](https://cve.now/CVE-2026-97685.md): LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations (CVSS 7.1, LimeSurvey)
- [CVE-2026-102241](https://cve.now/CVE-2026-102241.md): Netcore NAP930 Backup/Restore backup\_common.sh hard-coded key (CVSS 5.1, Netcore NAP930)
- [CVE-2026-102240](https://cve.now/CVE-2026-102240.md): Netcore NAP930 Network Tools CGI network\_tools eval os command injection (CVSS 10.0, Netcore NAP930)
- [CVE-2026-101878](https://cve.now/CVE-2026-101878.md): Bitwarden Server 2025.6.0 \< 2025.6.0 Authentication Bypass via SSO Identifier Truncation (CVSS 7.7, bitwarden server)
- [CVE-2026-101860](https://cve.now/CVE-2026-101860.md): RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management (CVSS 8.7, raspap-webgui)
- [CVE-2026-101859](https://cve.now/CVE-2026-101859.md): RaspAP raspap-webgui OpenVPN Configuration del\_ovpncfg.php escapeshellcmd os command injection (CVSS 5.3, raspap-webgui)
- [CVE-2026-96326](https://cve.now/CVE-2026-96326.md): HT Contact Form – Drag & Drop Form Builder for WordPress \<= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field (CVSS 7.2, htplugins HT Contact Form – Drag & Drop Form Builder for Wo…)
- [CVE-2026-101858](https://cve.now/CVE-2026-101858.md): RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection (CVSS 5.1, raspap-webgui)
- [CVE-2026-101354](https://cve.now/CVE-2026-101354.md): FAST FAC1203R MmtAtePrase \_tWlanTask stack-based overflow (CVSS 9.4, FAST FAC1203R)
- [CVE-2026-101281](https://cve.now/CVE-2026-101281.md): Trusted Domain Project OpenDMARC SPF Macro opendmarc\_spf.c opendmarc\_sp2\_find\_mailfrom\_domain improper authentication (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-102374](https://cve.now/CVE-2026-102374.md): GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector (CVSS 5.3, GestSup)
- [CVE-2026-102373](https://cve.now/CVE-2026-102373.md): GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter (CVSS 7.1, GestSup)
- [CVE-2026-102372](https://cve.now/CVE-2026-102372.md): GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector (CVSS 5.3, GestSup)
- [CVE-2026-101280](https://cve.now/CVE-2026-101280.md): Trusted Domain Project OpenDMARC Multi-Record Set opendmarc\_policy\_query\_dmarc authentication spoofing (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-101279](https://cve.now/CVE-2026-101279.md): Trusted Domain Project OpenDMARC opendmarc\_policy.c integer overflow (CVSS 6.9, Trusted Domain Project OpenDMARC)
- [CVE-2026-101278](https://cve.now/CVE-2026-101278.md): Trusted Domain Project OpenDMARC PSL Wildcard opendmarc\_tld.c : opendmarc\_get\_tld origin validation (CVSS 5.3, Trusted Domain Project OpenDMARC)
- [CVE-2024-31026](https://cve.now/CVE-2024-31026.md): An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat i (CVSS 9.8)
- [CVE-2024-31027](https://cve.now/CVE-2024-31027.md): Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arb (CVSS 5.4)
- [CVE-2026-39117](https://cve.now/CVE-2026-39117.md): An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary (CVSS 9.8)
- [CVE-2026-67987](https://cve.now/CVE-2026-67987.md): crmne/ruby\_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions i (CVSS 7.5)
- [CVE-2026-67993](https://cve.now/CVE-2026-67993.md): basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credenti (CVSS 8.8)
- [CVE-2026-77177](https://cve.now/CVE-2026-77177.md): Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom (CVSS 9.8)
- [CVE-2026-79348](https://cve.now/CVE-2026-79348.md): KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. (CVSS 4.3)
- [CVE-2026-79403](https://cve.now/CVE-2026-79403.md): An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint (CVSS 8.4)
- [CVE-2026-79417](https://cve.now/CVE-2026-79417.md): Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass (CVSS 5.3)
- [CVE-2026-79534](https://cve.now/CVE-2026-79534.md): mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystems (CVSS 5.9)
- [CVE-2026-79535](https://cve.now/CVE-2026-79535.md): mbailey VoiceMode \<= 8.10.1 is vulnerable to OS Command Injection. (CVSS 6.3)
- [CVE-2026-79536](https://cve.now/CVE-2026-79536.md): bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. (CVSS 9.1)
- [CVE-2026-79537](https://cve.now/CVE-2026-79537.md): metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. (CVSS 9.1)
- [CVE-2026-79538](https://cve.now/CVE-2026-79538.md): metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/s (CVSS 9.8)
- [CVE-2026-94952](https://cve.now/CVE-2026-94952.md): A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. (CVSS 9.8)
- [CVE-2026-94953](https://cve.now/CVE-2026-94953.md): A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. (CVSS 8.8)
- [CVE-2026-94954](https://cve.now/CVE-2026-94954.md): A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.