# CVEs published 2026-10-01

395 CVEs were published on October 1, 2026: 52 critical, 169 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-86345](https://cve.now/CVE-2026-86345.md): 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result (CVSS 9.0, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-103766](https://cve.now/CVE-2026-103766.md): ClipBucket v5 through 5.5.3-#197 SQL Injection via ads\_manager.php delete Parameter (CVSS 8.6, MacWarrior clipbucket-v5)
- [CVE-2026-103765](https://cve.now/CVE-2026-103765.md): Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server (CVSS 8.8, kvcache-ai Mooncake)
- [CVE-2026-103764](https://cve.now/CVE-2026-103764.md): Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport (CVSS 9.3, kvcache-ai Mooncake)
- [CVE-2026-103761](https://cve.now/CVE-2026-103761.md): Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue (CVSS 8.7, kvcache-ai Mooncake)
- [CVE-2026-103760](https://cve.now/CVE-2026-103760.md): Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write (CVSS 8.2, kvcache-ai Mooncake)
- [CVE-2025-71427](https://cve.now/CVE-2025-71427.md): Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save\_presentation and manage\_image (CVSS 7.6, GongRzhe Office-PowerPoint-MCP-Server)
- [CVE-2026-18397](https://cve.now/CVE-2026-18397.md): SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability (CVSS 9.4, Thales SConnect)
- [CVE-2026-86344](https://cve.now/CVE-2026-86344.md): 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue (CVSS 7.5, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-27873](https://cve.now/CVE-2026-27873.md): - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. (CVSS 5.6, Johnson Controls EasyIO FG)
- [CVE-2026-64893](https://cve.now/CVE-2026-64893.md): - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. (CVSS 7.3, Johnson Controls EasyIO NEO)
- [CVE-2026-64892](https://cve.now/CVE-2026-64892.md): - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. (CVSS 6.3, Johnson Controls Easy IO Neo)
- [CVE-2026-104356](https://cve.now/CVE-2026-104356.md): PictShare \< 3.7.1 Predictable Delete Code via rand() (CVSS 8.2, HaschekSolutions pictshare)
- [CVE-2026-34494](https://cve.now/CVE-2026-34494.md): - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. (CVSS 7.2, Johnson Controls Neo Series MVP2)
- [CVE-2026-34493](https://cve.now/CVE-2026-34493.md): - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. (CVSS 7.2, Johnson Controls EasyIO FS32)
- [CVE-2026-71449](https://cve.now/CVE-2026-71449.md): : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. (CVSS 9.3, Johnson Controls EasyIO FS32)
- [CVE-2026-71448](https://cve.now/CVE-2026-71448.md): : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. (CVSS 5.6, Johnson Controls EasyIO FS32)
- [CVE-2026-71454](https://cve.now/CVE-2026-71454.md): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 (CVSS 5.8, CWE-79 - Cross-site Scripting CAPEC-63)
- [CVE-2026-71453](https://cve.now/CVE-2026-71453.md): - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. (CVSS 5.6, Johnson Controls EasyIO FS32)
- [CVE-2026-104051](https://cve.now/CVE-2026-104051.md): PictShare \< 3.7.1 Sensitive Information Disclosure via info API (CVSS 8.8, HaschekSolutions pictshare)
- [CVE-2026-71452](https://cve.now/CVE-2026-71452.md): - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. (CVSS 7.2, Johnson Controls EasyIO FS32)
- [CVE-2026-104002](https://cve.now/CVE-2026-104002.md): Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) (CVSS 5.3, AWS powertools-lambda-python)
- [CVE-2026-71451](https://cve.now/CVE-2026-71451.md): - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. (CVSS 5.6, Johnson Controls EasyIO FS32)
- [CVE-2026-27874](https://cve.now/CVE-2026-27874.md): : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. (CVSS 5.0, Johnson Controls EasyIO FS32)
- [CVE-2026-102370](https://cve.now/CVE-2026-102370.md): Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71 (CVSS 5.4, TP-Link Systems Kasa EC70 · TP-Link Systems Kasa EC71)
- [CVE-2026-104020](https://cve.now/CVE-2026-104020.md): Uncontrolled recursion in the Ion reader in Amazon Ion Python (CVSS 7.5, Amazon ion-python)
- [CVE-2026-96780](https://cve.now/CVE-2026-96780.md): figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width (CVSS 8.2, patorjk figlet.js · figlet)
- [CVE-2026-104183](https://cve.now/CVE-2026-104183.md): stream-json: Prototype pollution: Assembler writes this.current\[this.key\] on plain objects (CVSS 5.1, uhop stream-json · stream-json)
- [CVE-2026-104182](https://cve.now/CVE-2026-104182.md): stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk (CVSS 6.2, uhop stream-json · stream-json)
- [CVE-2026-104181](https://cve.now/CVE-2026-104181.md): Filament: Multi-factor authentication (app) management actions do not require password reauthentication (CVSS 5.4, filamentphp filament · filament/filament)
- [CVE-2026-102514](https://cve.now/CVE-2026-102514.md): Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive (CVSS 8.4, PeaZip)
- [CVE-2026-55396](https://cve.now/CVE-2026-55396.md): Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2 (CVSS 8.5, Teledyne FLIR Aware2)
- [CVE-2026-55395](https://cve.now/CVE-2026-55395.md): Hardcoded Passwords in Teledyne FLIR Robots running Aware2 (CVSS 9.4, Teledyne FLIR Aware2)
- [CVE-2026-55394](https://cve.now/CVE-2026-55394.md): Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2 (CVSS 5.3, Teledyne FLIR Aware2)
- [CVE-2026-55393](https://cve.now/CVE-2026-55393.md): Local File Inclusion in Teledyne FLIR Robots running Aware2 (CVSS 10.0, Teledyne FLIR Aware2)
- [CVE-2026-14984](https://cve.now/CVE-2026-14984.md): Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2 (CVSS 9.4, Teledyne FLIR Aware2)
- [CVE-2026-14983](https://cve.now/CVE-2026-14983.md): Missing Authentication in Teledyne FLIR Robots running Aware2 (CVSS 7.1, Teledyne FLIR Aware2)
- [CVE-2026-53964](https://cve.now/CVE-2026-53964.md): Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes) (CVSS 7.2, adfinis document-merge-service · document-merge-service)
- [CVE-2026-55252](https://cve.now/CVE-2026-55252.md): OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect (CVSS 5.1, openrundev openrun · github.com/openrundev/openrun)
- [CVE-2026-55251](https://cve.now/CVE-2026-55251.md): NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files (CVSS 6.5, netbox-community devicetype-library)
- [CVE-2026-103484](https://cve.now/CVE-2026-103484.md): pgvector buffer overflow in IVFFlat index build (CVSS 8.8, pgvector)
- [CVE-2026-102628](https://cve.now/CVE-2026-102628.md): Cadmos LTI exposure of sensitive information via debug mode (CVSS 9.3, Eummena Cadmos LTI)
- [CVE-2026-100251](https://cve.now/CVE-2026-100251.md): Wormhole.app SSRF (CVSS 6.5, Wormhole App Wormhole)
- [CVE-2026-93832](https://cve.now/CVE-2026-93832.md): A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions f (CVSS 4.8, Motorola Setup App)
- [CVE-2026-102671](https://cve.now/CVE-2026-102671.md): Joyland AI WebView accepts invalid SSL certificates (CVSS 5.3, Joyland.ai)
- [CVE-2026-102670](https://cve.now/CVE-2026-102670.md): Joyland AI enables HTTP (CVSS 5.3, Joyland.ai)
- [CVE-2026-102669](https://cve.now/CVE-2026-102669.md): Joyland AI hostname checking disabled (CVSS 5.3, Joyland.ai)
- [CVE-2026-54049](https://cve.now/CVE-2026-54049.md): Sakai Conversations has a Stored XSS Issue (CVSS 8.7, sakaiproject sakai · org.sakaiproject.conversations:saka… +2)
- [CVE-2026-102668](https://cve.now/CVE-2026-102668.md): Joyland AI accepts TLS certificates without validation (CVSS 6.9, Joyland.ai)
- [CVE-2026-102667](https://cve.now/CVE-2026-102667.md): Joyland AI WebView command injection (CVSS 9.0, Joyland.ai)
- [CVE-2026-82358](https://cve.now/CVE-2026-82358.md): RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass (CVSS 6.5, RT-Labs AB C-Open)
- [CVE-2026-102666](https://cve.now/CVE-2026-102666.md): Joyland AI hard-coded credentials for push notifications (CVSS 6.5, Joyland.ai)
- [CVE-2026-82357](https://cve.now/CVE-2026-82357.md): RT-Labs AB C-Open CANopen NULL pointer dereference (CVSS 6.5, RT-Labs AB C-Open)
- [CVE-2026-71542](https://cve.now/CVE-2026-71542.md): GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php (CVSS 8.7, GetSimpleCMS-CE)
- [CVE-2026-71426](https://cve.now/CVE-2026-71426.md): GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field (CVSS 7.1, GetSimpleCMS-CE)
- [CVE-2026-70650](https://cve.now/CVE-2026-70650.md): GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content (CVSS 8.8, GetSimpleCMS-CE)
- [CVE-2026-56662](https://cve.now/CVE-2026-56662.md): GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request (CVSS 9.6, GetSimpleCMS-CE)
- [CVE-2026-56661](https://cve.now/CVE-2026-56661.md): GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint (CVSS 7.5, GetSimpleCMS-CE)
- [CVE-2026-56660](https://cve.now/CVE-2026-56660.md): GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction (CVSS 9.1, GetSimpleCMS-CE)
- [CVE-2026-53953](https://cve.now/CVE-2026-53953.md): GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover (CVSS 9.1, GetSimpleCMS-CE)
- [CVE-2026-104286](https://cve.now/CVE-2026-104286.md): An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, F (CVSS 9.8, KEV, Fortinet FortiMail)
- [CVE-2026-27872](https://cve.now/CVE-2026-27872.md): EasyIO FG (CVSS 5.6, Johnson Controls Easy IO FG)
- [CVE-2026-84682](https://cve.now/CVE-2026-84682.md): TDDPv2 setProductVer Command Injection in Archer AX90 (CVSS 7.7, TP-Link Systems Archer AX90)
- [CVE-2026-55232](https://cve.now/CVE-2026-55232.md): Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy (CVSS 7.6, givanz Vvveb)
- [CVE-2026-55230](https://cve.now/CVE-2026-55230.md): Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character (CVSS 8.7, givanz Vvveb)
- [CVE-2026-55231](https://cve.now/CVE-2026-55231.md): Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools (CVSS 7.2, givanz Vvveb)
- [CVE-2026-15911](https://cve.now/CVE-2026-15911.md): Confluent Kafka Python Improper TLS Certificate Validation (CVSS 7.4, confluent-kafka)
- [CVE-2026-104059](https://cve.now/CVE-2026-104059.md): Lektor 3.3.14 CSRF via Admin API Endpoints (CVSS 7.0, lektor)
- [CVE-2026-8618](https://cve.now/CVE-2026-8618.md): Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus (CVSS 7.7, TP-Link Systems Deco M9 Plus)
- [CVE-2026-104058](https://cve.now/CVE-2026-104058.md): Podgrab Missing Authentication on WebSocket /ws Endpoint (CVSS 6.3, akhilrex podgrab)
- [CVE-2026-104057](https://cve.now/CVE-2026-104057.md): Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler (CVSS 8.7, akhilrex podgrab)
- [CVE-2026-104056](https://cve.now/CVE-2026-104056.md): CVE-2026-104056 (CVSS 9.8, Authlib)
- [CVE-2026-55083](https://cve.now/CVE-2026-55083.md): DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) (CVSS 9.1, dhis2-core)
- [CVE-2026-102369](https://cve.now/CVE-2026-102369.md): Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200 (CVSS 8.7, TP-Link Systems Tapo C200 · TP-Link Systems Tapo C120)
- [CVE-2026-78578](https://cve.now/CVE-2026-78578.md): Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200 (CVSS 7.1, TP-Link Systems Tapo C200 · TP-Link Systems Tapo C120)
- [CVE-2026-78577](https://cve.now/CVE-2026-78577.md): Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200 (CVSS 5.3, TP-Link Systems Tapo C200 · TP-Link Systems Tapo C120)
- [CVE-2026-9032](https://cve.now/CVE-2026-9032.md): Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200 (CVSS 7.1, TP-Link Systems Tapo C200 · TP-Link Systems Tapo C120)
- [CVE-2026-103923](https://cve.now/CVE-2026-103923.md): KaTeX: Existing prototype pollution can bypass trust restrictions (CVSS 2.1, KaTeX)
- [CVE-2026-68496](https://cve.now/CVE-2026-68496.md): jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service (CVSS 7.5, FasterXML jackson-dataformats-binary)
- [CVE-2026-68495](https://cve.now/CVE-2026-68495.md): jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service (CVSS 7.5, FasterXML jackson-dataformats-binary)
- [CVE-2026-104018](https://cve.now/CVE-2026-104018.md): VxWorks 7 improper privilege management (CVSS 8.8, Wind River Systems VxWorks)
- [CVE-2026-97662](https://cve.now/CVE-2026-97662.md): Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace (CVSS 8.2, AWS security-agent-mcp-server)
- [CVE-2026-102294](https://cve.now/CVE-2026-102294.md): Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration (CVSS 8.5, TP-Link System TL-WR841N)
- [CVE-2026-103922](https://cve.now/CVE-2026-103922.md): Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path (CVSS 9.3, ionic-team capacitor · @capacitor android +6)
- [CVE-2026-103884](https://cve.now/CVE-2026-103884.md): Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-56098](https://cve.now/CVE-2026-56098.md): Rubygem-katello: improper authorization logic allows resource enumeration (CVSS 4.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-56097](https://cve.now/CVE-2026-56097.md): Rubygem-katello: sql injection in registry proxy via labels (CVSS 6.5, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-12542](https://cve.now/CVE-2026-12542.md): Foreman: command injection in foreman-tail (CVSS 5.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-12545](https://cve.now/CVE-2026-12545.md): Rubygem-hammer\_cli: command injection via insecure editor invocation (CVSS 6.7, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-73976](https://cve.now/CVE-2026-73976.md): djehuty: Unauthenticated SPARQL injection in the search API (\`order\`, \`operator\`, \`key\`) (CVSS 7.1, 4TUResearchData djehuty)
- [CVE-2026-21833](https://cve.now/CVE-2026-21833.md): HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833) (CVSS 3.7, HCL Software AION)
- [CVE-2026-73975](https://cve.now/CVE-2026-73975.md): djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples (CVSS 8.4, 4TUResearchData djehuty)
- [CVE-2026-77387](https://cve.now/CVE-2026-77387.md): geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point (CVSS 4.0, geopy)
- [CVE-2026-103921](https://cve.now/CVE-2026-103921.md): GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor (CVSS 7.4, ardatan graphql-tools · @graphql-tools executor-legacy-ws +1)
- [GHSA-9CQF-HHRQ-7V45](https://cve.now/GHSA-9CQF-HHRQ-7V45.md): SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class… (high (no CVSS), github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-96658](https://cve.now/CVE-2026-96658.md): Foreman: foreman: arbitrary code execution via safemode sandbox bypass (CVSS 8.8, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +2)
- [CVE-2026-96659](https://cve.now/CVE-2026-96659.md): Foreman: excessive permissions for viewer role on preview (CVSS 9.1, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +2)
- [CVE-2026-12544](https://cve.now/CVE-2026-12544.md): Foreman: ssti and insecure deserialization in foreman-rake configuration (CVSS 7.7, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-12541](https://cve.now/CVE-2026-12541.md): Foreman: command injection in foreman-rake database tasks (CVSS 8.2, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-101890](https://cve.now/CVE-2026-101890.md): Prime Mover \< 2.2.1 Stored XSS via Package Metadata (CVSS 5.1, Codexonics Prime Mover)
- [CVE-2026-12540](https://cve.now/CVE-2026-12540.md): Foreman: command injection in foreman-rake errors:fetch\_log via request\_id parameter (CVSS 8.2, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-12423](https://cve.now/CVE-2026-12423.md): Foreman: unauthenticated information disclosure via provisioning token validation flaw (CVSS 7.5, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-12405](https://cve.now/CVE-2026-12405.md): Rubygem-foreman\_remote\_execution: command injection in job invocations via effective\_user parameter (CVSS 8.8, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-101889](https://cve.now/CVE-2026-101889.md): Prime Mover \< 2.2.1 Path Traversal via wprime-config.json (CVSS 7.0, Codexonics Prime Mover)
- [CVE-2026-63686](https://cve.now/CVE-2026-63686.md): Apache HTTP Server: mod\_xml2enc crash on charset conversion failure (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-101888](https://cve.now/CVE-2026-101888.md): Prime Mover \< 2.2.1 Zip Slip Path Traversal File Write (CVSS 8.6, Codexonics Prime Mover)
- [CVE-2026-93546](https://cve.now/CVE-2026-93546.md): Apache HTTP Server: mod\_dav\_fs namespace overflow (CVSS 8.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-79768](https://cve.now/CVE-2026-79768.md): Apache HTTP Server: mod\_userdir information disclosure (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-73637](https://cve.now/CVE-2026-73637.md): Apache HTTP Server: mod\_auth\_digest DoS attack (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-73636](https://cve.now/CVE-2026-73636.md): Apache HTTP Server: mod\_auth\_digest one-time-nonce replay attack (CVSS 8.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-31980](https://cve.now/CVE-2025-31980.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 4.3, HCL Software HCL BigFix Service Management)
- [CVE-2026-63718](https://cve.now/CVE-2026-63718.md): Apache HTTP Server: mod\_proxy\_uwsgi Transfer-Encoding response smuggling (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-14316](https://cve.now/CVE-2026-14316.md): Heap buffer overflow in boks\_sshd revoked-key error handling (CVSS 8.1, Fortra Core Privileged Access Manager)
- [CVE-2026-67172](https://cve.now/CVE-2026-67172.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL BigFix Service Management)
- [CVE-2026-67171](https://cve.now/CVE-2026-67171.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 5.3, HCL Software HCL BigFix Service Management)
- [CVE-2026-63292](https://cve.now/CVE-2026-63292.md): Apache HTTP Server: mod\_vhost\_alias stack overflow (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-63045](https://cve.now/CVE-2026-63045.md): Apache HTTP Server: mod\_proxy\_ftp PASV address handling (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-59797](https://cve.now/CVE-2026-59797.md): Apache HTTP Server: mod\_ssl SSLRequire allows .htaccess ap\_expr file-function (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-59685](https://cve.now/CVE-2026-59685.md): Apache HTTP Server: Out-of-Bounds Write in ap\_directory\_walk() Canonical-Name Rewrite on CASE\_BLIND\_FILESYSTEM (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-13043](https://cve.now/CVE-2026-13043.md): WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access (CVSS 9.3, WatchGuard Endpoint Security)
- [CVE-2026-58415](https://cve.now/CVE-2026-58415.md): Apache HTTP Server: mod\_dav\_fs property database read access (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-57941](https://cve.now/CVE-2026-57941.md): Apache HTTP Server: mod\_http2 use-after-free / wild write via shared session-\>bbtmp re-entrancy (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-56449](https://cve.now/CVE-2026-56449.md): Apache HTTP Server: mod\_proxy\_html: crash in dump\_content (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-56154](https://cve.now/CVE-2026-56154.md): Apache HTTP Server: mod\_rewrite use-after-free via %{LA-U:HTTP:...} (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-56153](https://cve.now/CVE-2026-56153.md): Apache HTTP Server: mod\_charset\_lite: Heap overflow in finish\_partial\_char (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-48005](https://cve.now/CVE-2026-48005.md): Apache HTTP Server: mod\_auth\_digest reauthentication attack (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-47360](https://cve.now/CVE-2026-47360.md): Apache HTTP Server: mod\_session: Session cookie not removed during internal redirect (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-101322](https://cve.now/CVE-2026-101322.md): In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastru (CVSS 8.3, Eclipse Foundation Eclipse BaSyx AAS Web UI)
- [CVE-2026-9864](https://cve.now/CVE-2026-9864.md): Fortra BoKS Server Agent adjoin machine-account password generation vulnerability (CVSS 4.8, Fortra Core Privileged Access Manager)
- [CVE-2026-103690](https://cve.now/CVE-2026-103690.md): itsourcecode Leave Management System controller.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-46729](https://cve.now/CVE-2026-46729.md): Apache HTTP Server: mod\_heartmonitor denial of service (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-42356](https://cve.now/CVE-2026-42356.md): Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories (CVSS 3.7, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-42528](https://cve.now/CVE-2026-42528.md): Apache HTTP Server: mod\_dav shared lock overflow (CVSS 4.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-94620](https://cve.now/CVE-2026-94620.md): Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download) (CVSS 9.4, foundation50 classroom50)
- [CVE-2026-103505](https://cve.now/CVE-2026-103505.md): AWS EFS CSI Driver Mount Option Injection via mounttargetipmap (CVSS 6.5, aws-efs-csi-driver)
- [CVE-2026-12627](https://cve.now/CVE-2026-12627.md): Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability (CVSS 9.8, Fortra's Core Privileged Access Manager)
- [CVE-2026-79896](https://cve.now/CVE-2026-79896.md): Fortra BoKS Manager boks\_portmux TLS ClientHello out-of-bounds read vulnerability (CVSS 7.5, Fortra BoKS Manager)
- [CVE-2026-17053](https://cve.now/CVE-2026-17053.md): SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state (CVSS 4.4, zephyrproject zephyr)
- [CVE-2026-67106](https://cve.now/CVE-2026-67106.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 5.3, HCL Software HCL BigFix Service Management)
- [CVE-2026-56599](https://cve.now/CVE-2026-56599.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 2.2, HCL Software HCL BigFix Service Management)
- [CVE-2026-67104](https://cve.now/CVE-2026-67104.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 5.3, HCL Software HCL BigFix Service Management)
- [CVE-2026-67105](https://cve.now/CVE-2026-67105.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 7.4, HCL Software HCL BigFix Service Management)
- [CVE-2026-79898](https://cve.now/CVE-2026-79898.md): Fortra BoKS Manager crlserver command injection vulnerability (CVSS 9.1, Fortra BoKS Manager)
- [CVE-2026-56589](https://cve.now/CVE-2026-56589.md): HCL BigFix Service Management is affected by multiple security vulnerabilities. (CVSS 7.2, HCL Software HCL BigFix Service Management)
- [CVE-2026-97280](https://cve.now/CVE-2026-97280.md): WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability (CVSS 6.5, Mamunur Rashid Review Schema)
- [CVE-2026-103004](https://cve.now/CVE-2026-103004.md): next.js cache leak on warm \`use cache\` handlers accessing root param (CVSS 6.3, vercel next.js · next)
- [CVE-2026-79899](https://cve.now/CVE-2026-79899.md): Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability (CVSS 7.9, Fortra BoKS Manager)
- [CVE-2026-103347](https://cve.now/CVE-2026-103347.md): WordPress hCaptcha for WP plugin \<= 5.3.0 - Bypass Vulnerability vulnerability (CVSS 5.3, hCaptcha for WP)
- [CVE-2026-103068](https://cve.now/CVE-2026-103068.md): WordPress ByteCoreStack – MCP Connector for AI Tools plugin \<= 1.2.2 - Privilege Escalation vulnerability (CVSS 8.8, ByteCore Stack ByteCoreStack &#8211; MCP Connector for AI T…)
- [CVE-2026-102378](https://cve.now/CVE-2026-102378.md): WordPress Parallax Section block plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bPlugins Parallax Section block)
- [CVE-2026-100517](https://cve.now/CVE-2026-100517.md): WordPress Photo Reviews for WooCommerce plugin \<= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, VillaTheme Photo Reviews for WooCommerce)
- [CVE-2026-100514](https://cve.now/CVE-2026-100514.md): WordPress REST API Log plugin \<= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, Pete Nelson REST API Log)
- [CVE-2026-97297](https://cve.now/CVE-2026-97297.md): WordPress Gratisfaction plugin \<= 4.6.3 - Broken Access Control vulnerability (CVSS 7.6, Apps Mav Gratisfaction)
- [CVE-2026-97284](https://cve.now/CVE-2026-97284.md): WordPress Icegram plugin \<= 3.1.31 - PHP Object Injection vulnerability (CVSS 8.8, Icegram)
- [CVE-2026-97281](https://cve.now/CVE-2026-97281.md): WordPress WP Project Manager plugin \<= 4.0.7 - Broken Access Control vulnerability (CVSS 6.3, weDevs WP Project Manager)
- [CVE-2026-97277](https://cve.now/CVE-2026-97277.md): WordPress Social Boost plugin \<= 3.6.2 - Broken Access Control vulnerability (CVSS 7.6, Apps Mav Social Boost)
- [CVE-2026-97273](https://cve.now/CVE-2026-97273.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Premmerce Wishlist for WooCommerce)
- [CVE-2026-97269](https://cve.now/CVE-2026-97269.md): WordPress WPFunnels plugin \<= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, WPFunnels)
- [CVE-2026-97268](https://cve.now/CVE-2026-97268.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Premmerce Wishlist for WooCommerce)
- [CVE-2026-97260](https://cve.now/CVE-2026-97260.md): WordPress MaxGalleria plugin \<= 6.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, maxfoundry MaxGalleria)
- [CVE-2026-97258](https://cve.now/CVE-2026-97258.md): WordPress Aruba Migration Tool plugin \<= 1.0.4 - Broken Access Control vulnerability (CVSS 6.5, Aruba.it Aruba Migration Tool)
- [CVE-2026-97251](https://cve.now/CVE-2026-97251.md): WordPress Bus Ticket Booking with Seat Reservation plugin \<= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, magepeopleteam Bus Ticket Booking with Seat Reservation)
- [CVE-2026-95588](https://cve.now/CVE-2026-95588.md): WordPress AcyMailing SMTP Newsletter plugin \<= 11.0.5 - Arbitrary File Deletion vulnerability (CVSS 8.6, AcyMailing Newsletter Team AcyMailing SMTP Newsletter)
- [CVE-2026-94390](https://cve.now/CVE-2026-94390.md): WordPress Hide Shipping Method For WooCommerce plugin \<= 1.5.4 - PHP Object Injection vulnerability (CVSS 7.2, Dotstore Hide Shipping Method For WooCommerce)
- [CVE-2026-62073](https://cve.now/CVE-2026-62073.md): WordPress WP Full Stripe Free plugin \<= 8.5.6 - Broken Access Control vulnerability (CVSS 7.5, Themeisle WP Full Stripe Free)
- [CVE-2026-62071](https://cve.now/CVE-2026-62071.md): WordPress WordPress File Upload plugin \<= 5.1.10 - SQL Injection vulnerability (CVSS 9.3, nickboss WordPress File Upload)
- [CVE-2026-103752](https://cve.now/CVE-2026-103752.md): WordPress Authorizer plugin \<= 3.15.3 - Privilege Escalation vulnerability (CVSS 9.8, Paul Ryan Authorizer)
- [CVE-2026-103687](https://cve.now/CVE-2026-103687.md): rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist (CVSS 6.9, rhukster dom-sanitizer)
- [CVE-2024-58388](https://cve.now/CVE-2024-58388.md): Sharp Multifunction Printers Local File Inclusion via installed\_emanual\_down.html (CVSS 8.7, Sharp Multiple Multifunction Printers · Toshiba Tec Multipl…)
- [CVE-2026-79900](https://cve.now/CVE-2026-79900.md): Heap overflow in KSL checksum initialization (CVSS 6.5, Fortra BoKS Manager boks-server)
- [CVE-2026-79901](https://cve.now/CVE-2026-79901.md): Predictable Active Directory service-account passwords in BoKS Manager (CVSS 9.9, Fortra BoKS Manager boks-server)
- [CVE-2026-103686](https://cve.now/CVE-2026-103686.md): rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting (CVSS 5.1, rhukster dom-sanitizer)
- [CVE-2026-66253](https://cve.now/CVE-2026-66253.md): HCL iControl is affected by a Session Timeout vulnerability (CVSS 3.1, HCL Software iControl)
- [CVE-2026-66249](https://cve.now/CVE-2026-66249.md): HCL iControl is affected by a Missing Secure Attribute vulnerability (CVSS 3.1, HCL Software iControl)
- [CVE-2026-66248](https://cve.now/CVE-2026-66248.md): HCL iControl is affected by an Improper Error Handling vulnerability (CVSS 3.1, HCL Software iControl)
- [CVE-2026-66247](https://cve.now/CVE-2026-66247.md): iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to exec (CVSS 4.3, HCL Software iControl)
- [CVE-2026-66246](https://cve.now/CVE-2026-66246.md): HCL iControl is affected by multiple security vulnerabilities (CVSS 8.8, HCL Software iControl)
- [CVE-2026-102505](https://cve.now/CVE-2026-102505.md): Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i\_gsampf\_fp (CVSS 6.3, Imager)
- [CVE-2026-102504](https://cve.now/CVE-2026-102504.md): Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw\_datachannels value in i\_readraw\_wiol (CVSS 7.5, Imager)
- [CVE-2026-62058](https://cve.now/CVE-2026-62058.md): WordPress CF7 Apps plugin \<= 3.7.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, WPExperts CF7 Apps)
- [CVE-2026-62059](https://cve.now/CVE-2026-62059.md): WordPress Ultimate Member plugin \<= 2.13.1 - SQL Injection vulnerability (CVSS 7.6, Ultimate Member)
- [CVE-2026-62060](https://cve.now/CVE-2026-62060.md): WordPress Captivate Sync plugin \<= 3.3.2 - SQL Injection vulnerability (CVSS 7.6, captivateaudio Captivate Sync)
- [CVE-2026-62061](https://cve.now/CVE-2026-62061.md): WordPress ProfileGrid plugin \<= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Metagauss ProfileGrid)
- [CVE-2026-62063](https://cve.now/CVE-2026-62063.md): WordPress WpTravelly plugin \<= 2.3.1 - Broken Access Control vulnerability (CVSS 5.4, Magepeople WpTravelly)
- [CVE-2026-102394](https://cve.now/CVE-2026-102394.md): WordPress Essential Addons for Elementor plugin \<= 6.8.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Essential Addons for Elementor)
- [CVE-2026-103339](https://cve.now/CVE-2026-103339.md): WordPress Metform plugin \<= 4.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wpmet Metform)
- [CVE-2026-102379](https://cve.now/CVE-2026-102379.md): WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin \<= 1.0.28 - SQL Injection vulnerability (CVSS 8.5, VillaTheme BuildKit – Product Builder for WooCommerce – Cus…)
- [CVE-2026-103063](https://cve.now/CVE-2026-103063.md): WordPress ElementsKit Elementor addons Lite plugin \<= 4.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wpmet ElementsKit Elementor addons Lite)
- [CVE-2026-103345](https://cve.now/CVE-2026-103345.md): WordPress Pie Register plugin \<= 3.8.4.13 - Sensitive Data Exposure vulnerability (CVSS 5.3, Shamim Rajani Pie Register)
- [CVE-2026-103064](https://cve.now/CVE-2026-103064.md): WordPress ElementsKit Elementor addons Lite plugin \<= 4.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wpmet ElementsKit Elementor addons Lite)
- [CVE-2026-102390](https://cve.now/CVE-2026-102390.md): WordPress AFFI – Affiliate Marketing for WooCommerce plugin \<= 1.0.9 - Broken Access Control vulnerability (CVSS 5.3, VillaTheme AFFI – Affiliate Marketing for WooCommerce)
- [CVE-2026-102382](https://cve.now/CVE-2026-102382.md): WordPress Majestic Support plugin \<= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Ahmad Majestic Support)
- [CVE-2026-102381](https://cve.now/CVE-2026-102381.md): WordPress Majestic Support plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 5.3, Ahmad Majestic Support)
- [CVE-2026-103343](https://cve.now/CVE-2026-103343.md): WordPress FluentForm plugin \<= 6.2.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP ManageNinja FluentForm)
- [CVE-2026-103341](https://cve.now/CVE-2026-103341.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.20 - Broken Access Control vulnerability (CVSS 5.3, Unlimited Elements For Elementor)
- [CVE-2026-103340](https://cve.now/CVE-2026-103340.md): WordPress Site Reviews plugin \<= 8.3.2 - Broken Access Control vulnerability (CVSS 5.3, Gemini Labs Site Reviews)
- [CVE-2026-103338](https://cve.now/CVE-2026-103338.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.20 - SQL Injection vulnerability (CVSS 8.5, Unlimited Elements For Elementor)
- [CVE-2026-103067](https://cve.now/CVE-2026-103067.md): WordPress Memberful - Membership Plugin plugin \<= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.0, Memberful - Membership Plugin)
- [CVE-2026-103754](https://cve.now/CVE-2026-103754.md): Ansible-runner: ansible-runner: path traversal and symlink escape in unstream\_dir() allows file write outside the target directory (CVSS 5.9, Red Hat Ansible Automation Platform)
- [CVE-2026-103336](https://cve.now/CVE-2026-103336.md): WordPress WP Ultimate CSV Importer plugin \<= 9.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, Smackcoders WP Ultimate CSV Importer)
- [CVE-2026-103680](https://cve.now/CVE-2026-103680.md): Tnef: heap buffer overflow in find\_free\_number() via numbered-backup suffix generation (CVSS 3.1, tnef)
- [CVE-2026-103679](https://cve.now/CVE-2026-103679.md): Tnef: use-after-free and double-free in get\_body\_files() via multi-value body extraction (CVSS 6.5, tnef)
- [CVE-2026-103678](https://cve.now/CVE-2026-103678.md): Tnef: heap out-of-bounds read in get\_rtf\_data\_from\_buf() via uncompressed rtf mapi value (CVSS 5.4, tnef)
- [CVE-2026-103858](https://cve.now/CVE-2026-103858.md): MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions (CVSS 5.3, MISP)
- [CVE-2026-94276](https://cve.now/CVE-2026-94276.md): Apache APISIX: Openid-connect introspection validation issue (CVSS 5.1, Apache Software Foundation Apache APISIX)
- [CVE-2026-94269](https://cve.now/CVE-2026-94269.md): Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch (CVSS 6.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-94250](https://cve.now/CVE-2026-94250.md): Apache APISIX: Batch response aggregation can exhaust worker memory (CVSS 8.2, Apache Software Foundation Apache APISIX)
- [CVE-2026-94220](https://cve.now/CVE-2026-94220.md): Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin (CVSS 2.1, Apache Software Foundation Apache APISIX)
- [CVE-2026-94212](https://cve.now/CVE-2026-94212.md): Apache APISIX: unauthenticated impersonation issue in saml-auth (CVSS 6.4, Apache Software Foundation Apache APISIX)
- [CVE-2026-82806](https://cve.now/CVE-2026-82806.md): Apache APISIX: cross-request permission pollution via static permission list mutation (CVSS 5.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-78242](https://cve.now/CVE-2026-78242.md): Apache APISIX: data-mask may fail to redact request headers in logger output (CVSS 5.7, Apache Software Foundation Apache APISIX)
- [CVE-2026-88789](https://cve.now/CVE-2026-88789.md): Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening (CVSS 8.6, Apache Software Foundation Apache Camel Quarkus)
- [CVE-2026-103353](https://cve.now/CVE-2026-103353.md): WordPress FluentForm plugin \<= 6.2.14 - Broken Access Control vulnerability (CVSS 5.3, WP ManageNinja FluentForm)
- [CVE-2026-103758](https://cve.now/CVE-2026-103758.md): Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route (CVSS 8.6, obot-platform obot)
- [CVE-2026-103757](https://cve.now/CVE-2026-103757.md): Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation (CVSS 8.3, budibase)
- [CVE-2026-103292](https://cve.now/CVE-2026-103292.md): Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost\_head (CVSS 8.6, TryGhost Ghost · ghost)
- [CVE-2026-103291](https://cve.now/CVE-2026-103291.md): Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103290](https://cve.now/CVE-2026-103290.md): Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize (CVSS 5.1, TryGhost Ghost · ghost)
- [CVE-2026-103289](https://cve.now/CVE-2026-103289.md): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments (CVSS 7.1, TryGhost Ghost · ghost)
- [CVE-2026-103288](https://cve.now/CVE-2026-103288.md): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like (CVSS 7.1, TryGhost Ghost · ghost)
- [CVE-2026-103287](https://cve.now/CVE-2026-103287.md): Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook (CVSS 5.1, TryGhost Ghost · ghost)
- [CVE-2026-103286](https://cve.now/CVE-2026-103286.md): Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications (CVSS 8.5, TryGhost Ghost · ghost)
- [CVE-2026-103285](https://cve.now/CVE-2026-103285.md): Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103284](https://cve.now/CVE-2026-103284.md): Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103283](https://cve.now/CVE-2026-103283.md): Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling (CVSS 8.6, TryGhost Ghost · ghost)
- [CVE-2026-103282](https://cve.now/CVE-2026-103282.md): Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103281](https://cve.now/CVE-2026-103281.md): Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103280](https://cve.now/CVE-2026-103280.md): Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint (CVSS 6.9, TryGhost Ghost · ghost)
- [CVE-2026-103279](https://cve.now/CVE-2026-103279.md): Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass (CVSS 7.6, TryGhost Ghost · ghost)
- [CVE-2026-103278](https://cve.now/CVE-2026-103278.md): Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe (CVSS 8.5, TryGhost Ghost · ghost)
- [CVE-2026-103277](https://cve.now/CVE-2026-103277.md): Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed (CVSS 8.6, TryGhost Ghost · ghost)
- [CVE-2026-103276](https://cve.now/CVE-2026-103276.md): Ghost before 6.20.0 File Read via URL Encoding Bypass (CVSS 6.9, TryGhost Ghost · ghost)
- [CVE-2026-103275](https://cve.now/CVE-2026-103275.md): Ghost 5.42.2 before 6.58.0 Password Hash Disclosure (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103274](https://cve.now/CVE-2026-103274.md): Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read (CVSS 6.9, TryGhost Ghost · ghost)
- [CVE-2026-103273](https://cve.now/CVE-2026-103273.md): Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103272](https://cve.now/CVE-2026-103272.md): Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API (CVSS 8.7, TryGhost Ghost · ghost)
- [CVE-2026-103271](https://cve.now/CVE-2026-103271.md): Ghost 4.0.0 before 6.63.0 Restricted Content Bypass (CVSS 8.7, TryGhost Ghost · ghost)
- [CVE-2026-103269](https://cve.now/CVE-2026-103269.md): Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts (CVSS 6.9, TryGhost Ghost · ghost)
- [CVE-2026-103268](https://cve.now/CVE-2026-103268.md): Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset (CVSS 8.7, TryGhost Ghost · ghost)
- [CVE-2026-103267](https://cve.now/CVE-2026-103267.md): Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-103266](https://cve.now/CVE-2026-103266.md): Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification (CVSS 7.1, TryGhost Ghost · ghost)
- [CVE-2026-103265](https://cve.now/CVE-2026-103265.md): Fleet before 4.89.0 Information Disclosure via MDM Command Results (CVSS 5.3, fleetdm fleet)
- [CVE-2026-103264](https://cve.now/CVE-2026-103264.md): Fleet before 4.87.0 Authentication Bypass via Device Identifiers (CVSS 9.3, fleetdm fleet)
- [CVE-2026-103263](https://cve.now/CVE-2026-103263.md): Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink (CVSS 8.2, tornadoweb tornado · tornado)
- [CVE-2026-103262](https://cve.now/CVE-2026-103262.md): Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient (CVSS 8.7, tornadoweb tornado · tornado)
- [CVE-2026-103261](https://cve.now/CVE-2026-103261.md): Tornado before 6.5.9 Denial of Service via Query String (CVSS 6.9, tornadoweb tornado · tornado)
- [CVE-2026-103260](https://cve.now/CVE-2026-103260.md): n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node (CVSS 6.3, n8n-io n8n)
- [CVE-2026-103259](https://cve.now/CVE-2026-103259.md): n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials (CVSS 8.5, n8n-io n8n)
- [CVE-2026-103258](https://cve.now/CVE-2026-103258.md): n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation (CVSS 6.9, n8n-io n8n)
- [CVE-2026-103257](https://cve.now/CVE-2026-103257.md): n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node (CVSS 8.1, n8n-io n8n)
- [CVE-2026-103256](https://cve.now/CVE-2026-103256.md): n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook (CVSS 7.1, n8n-io n8n)
- [CVE-2026-103255](https://cve.now/CVE-2026-103255.md): n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase (CVSS 7.1, n8n-io n8n)
- [CVE-2026-103254](https://cve.now/CVE-2026-103254.md): n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation (CVSS 7.0, n8n-io n8n)
- [CVE-2026-103253](https://cve.now/CVE-2026-103253.md): n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table (CVSS 7.0, n8n-io n8n)
- [CVE-2026-103252](https://cve.now/CVE-2026-103252.md): n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint (CVSS 7.1, n8n-io n8n)
- [CVE-2026-103251](https://cve.now/CVE-2026-103251.md): n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub (CVSS 7.5, n8n-io n8n)
- [CVE-2026-103250](https://cve.now/CVE-2026-103250.md): n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory (CVSS 7.0, n8n-io n8n)
- [CVE-2026-103249](https://cve.now/CVE-2026-103249.md): n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator (CVSS 6.9, n8n-io n8n)
- [CVE-2026-103248](https://cve.now/CVE-2026-103248.md): n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase (CVSS 7.1, n8n-io n8n)
- [CVE-2026-103247](https://cve.now/CVE-2026-103247.md): n8n before 1.123.80 Credential Tampering via Duplicate Node IDs (CVSS 5.8, n8n-io n8n)
- [CVE-2026-103246](https://cve.now/CVE-2026-103246.md): n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection (CVSS 8.3, n8n-io n8n)
- [CVE-2026-103245](https://cve.now/CVE-2026-103245.md): n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification (CVSS 6.9, n8n-io n8n)
- [CVE-2026-103244](https://cve.now/CVE-2026-103244.md): ground-station before 0.8.0 Authentication Bypass via setup.restore (CVSS 9.3, sgoudelis ground-station)
- [CVE-2026-103082](https://cve.now/CVE-2026-103082.md): WordPress LA-Studio Element Kit for Elementor plugin \<= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, LA-Studio Element Kit for Elementor)
- [CVE-2026-7176](https://cve.now/CVE-2026-7176.md): Multiple vulnerabilities in Entradium by Crocantickets (CVSS 4.8, Crocantickets Entradium)
- [CVE-2026-7175](https://cve.now/CVE-2026-7175.md): Multiple vulnerabilities in Entradium by Crocantickets (CVSS 4.8, Crocantickets Entradium)
- [CVE-2026-7174](https://cve.now/CVE-2026-7174.md): Multiple vulnerabilities in Entradium by Crocantickets (CVSS 4.8, Crocantickets Entradium)
- [CVE-2026-7173](https://cve.now/CVE-2026-7173.md): Multiple vulnerabilities in Entradium by Crocantickets (CVSS 4.8, Crocantickets Entradium)
- [CVE-2026-75786](https://cve.now/CVE-2026-75786.md): SQL Injection in Grafana Integration Endpoint (query.php) (CVSS 7.2, Pandora FMS)
- [CVE-2026-64950](https://cve.now/CVE-2026-64950.md): Stored Cross-Site Scripting via Directory Name in File Manager Create Directory (CVSS 8.4, Pandora FMS)
- [CVE-2026-64949](https://cve.now/CVE-2026-64949.md): Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager (CVSS 8.6, Pandora FMS)
- [CVE-2026-64948](https://cve.now/CVE-2026-64948.md): Missing Authorization in get\_module\_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure (CVSS 7.1, Pandora FMS)
- [CVE-2026-64947](https://cve.now/CVE-2026-64947.md): CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager (CVSS 7.5, Pandora FMS)
- [CVE-2026-92144](https://cve.now/CVE-2026-92144.md): Forminator Forms \<= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1\[post-custom\]' Parameter (CVSS 7.2, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-96256](https://cve.now/CVE-2026-96256.md): Gutenberg Essential Blocks \<= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2026-64946](https://cve.now/CVE-2026-64946.md): CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager (CVSS 7.4, Pandora FMS)
- [CVE-2026-34190](https://cve.now/CVE-2026-34190.md): CSRF in Alert Command Deletion (CVSS 5.9, Pandora FMS)
- [CVE-2026-34189](https://cve.now/CVE-2026-34189.md): CSRF in Event Response Deletion (CVSS 5.9, Pandora FMS)
- [CVE-2026-96577](https://cve.now/CVE-2026-96577.md): Oc-mirror\_\_release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled (CVSS 7.1, Red Hat OpenShift Container Platform · Assisted Installer f…)
- [CVE-2026-83589](https://cve.now/CVE-2026-83589.md): Oauth-proxy: open redirect via /\\ and /\\t bypass in post-login redirect (CVSS 6.1, Red Hat OpenShift Container Platform)
- [CVE-2026-103497](https://cve.now/CVE-2026-103497.md): In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration (CVSS 5.5, JetBrains YouTrack)
- [CVE-2026-103496](https://cve.now/CVE-2026-103496.md): In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications (CVSS 5.4, JetBrains YouTrack)
- [CVE-2026-103495](https://cve.now/CVE-2026-103495.md): In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs (CVSS 4.3, JetBrains YouTrack)
- [CVE-2026-103494](https://cve.now/CVE-2026-103494.md): In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes (CVSS 6.6, JetBrains YouTrack)
- [CVE-2026-103493](https://cve.now/CVE-2026-103493.md): In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible (CVSS 8.1, JetBrains YouTrack)
- [CVE-2026-103492](https://cve.now/CVE-2026-103492.md): In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments (CVSS 6.5, JetBrains YouTrack)
- [CVE-2026-103491](https://cve.now/CVE-2026-103491.md): In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues (CVSS 6.5, JetBrains YouTrack)
- [CVE-2026-103490](https://cve.now/CVE-2026-103490.md): In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links (CVSS 7.2, JetBrains YouTrack)
- [CVE-2026-103489](https://cve.now/CVE-2026-103489.md): In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible (CVSS 2.0, JetBrains YouTrack)
- [CVE-2026-103488](https://cve.now/CVE-2026-103488.md): In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re (CVSS 7.1, JetBrains YouTrack)
- [CVE-2026-103664](https://cve.now/CVE-2026-103664.md): MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter (CVSS 4.8, MISP)
- [CVE-2026-103662](https://cve.now/CVE-2026-103662.md): MISP Reflected XSS in Taxonomy Tag Confirmation Forms (CVSS 5.1, MISP)
- [CVE-2026-103431](https://cve.now/CVE-2026-103431.md): Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances (CVSS 7.7, collectl)
- [CVE-2026-103659](https://cve.now/CVE-2026-103659.md): MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes (CVSS 7.1, MISP)
- [CVE-2026-97661](https://cve.now/CVE-2026-97661.md): Business Essentials for Contact Form 7 \<= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field (CVSS 7.2, scottpaterson Business Essentials for Contact Form)
- [CVE-2026-89424](https://cve.now/CVE-2026-89424.md): Duplicate Post \<= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti\_token' Parameter (CVSS 6.4, inisev Duplicate Post)
- [CVE-2026-89427](https://cve.now/CVE-2026-89427.md): Ad Inserter \<= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter (CVSS 6.1, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2026-96813](https://cve.now/CVE-2026-96813.md): Form Maker by 10Web \<= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields (CVSS 7.2, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-100184](https://cve.now/CVE-2026-100184.md): Calculated Fields Form \<= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value (CVSS 4.7, codepeople Calculated Fields Form – AI Form Builder for Wor…)
- [CVE-2026-96268](https://cve.now/CVE-2026-96268.md): Awesome Support \<= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas\_gdpr\_user\_opt\_out AJAX Action (CVSS 6.4, awesomesupport Awesome Support – WordPress HelpDesk & Suppo…)
- [CVE-2026-95687](https://cve.now/CVE-2026-95687.md): WPC Shop as a Customer for WooCommerce \<= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa\_login AJAX Endpoint (CVSS 8.8, wpclever WPC Shop as a Customer for WooCommerce)
- [CVE-2026-101925](https://cve.now/CVE-2026-101925.md): bbp style pack \<= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name (CVSS 6.4, robin-w bbp style pack)
- [CVE-2026-96573](https://cve.now/CVE-2026-96573.md): Appointment Hour Booking \<= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer (CVSS 7.2, codepeople Appointment Hour Booking – Booking Calendar)
- [CVE-2026-85235](https://cve.now/CVE-2026-85235.md): Forminator Forms \<= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (CVSS 7.2, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-92244](https://cve.now/CVE-2026-92244.md): PDF Invoices & Packing Slips for WooCommerce \<= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields (CVSS 7.2, wpovernight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2026-15983](https://cve.now/CVE-2026-15983.md): Super Forms \<= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter (CVSS 8.1, WebRehab Super Forms – Drag & Drop Form Builder)
- [CVE-2026-90992](https://cve.now/CVE-2026-90992.md): Redux Framework \<= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-100179](https://cve.now/CVE-2026-100179.md): Calculated Fields Form \<= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices() (CVSS 6.1, codepeople Calculated Fields Form – AI Form Builder for Wor…)
- [CVE-2026-14995](https://cve.now/CVE-2026-14995.md): Autoptimize \<= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST\_URI Path (CVSS 7.2, optimizingmatters Autoptimize)
- [CVE-2026-103655](https://cve.now/CVE-2026-103655.md): MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period (CVSS 9.3, MISP)
- [CVE-2026-78249](https://cve.now/CVE-2026-78249.md): A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 (CVSS 6.8, Fujifilm Business Innovation Apeos 3060 / 2560 / 1860 J… +67)
- [CVE-2026-19807](https://cve.now/CVE-2026-19807.md): ByteCoreStack \<= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp\_update\_user\_meta MCP Tool (CVSS 8.8, ByteCoreStack – MCP Connector for AI Tools)
- [CVE-2026-15989](https://cve.now/CVE-2026-15989.md): Super Forms \<= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter (CVSS 9.8, WebRehab Super Forms – Drag & Drop Form Builder)
- [CVE-2026-75957](https://cve.now/CVE-2026-75957.md): Ultimate Multisite \<= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout\_form' Parameter (CVSS 9.8, superdav42 Ultimate Multisite – WordPress Multisite SaaS &…)
- [CVE-2026-19902](https://cve.now/CVE-2026-19902.md): Ad Inserter \<= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header) (CVSS 6.1, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2026-93882](https://cve.now/CVE-2026-93882.md): LearnPress \<= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item\_id' Parameter (CVSS 7.5, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-89047](https://cve.now/CVE-2026-89047.md): Social Media Share Buttons & Social Sharing Icons \<= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL (CVSS 6.1, inisev Social Media Share Buttons & Social Sharing Icons)
- [CVE-2026-103651](https://cve.now/CVE-2026-103651.md): MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass (CVSS 7.6, MISP)
- [CVE-2025-41753](https://cve.now/CVE-2025-41753.md): Path traversal in dynamically created BACnet File Objects (CVSS 9.3, WAGO 0751-9x01 · WAGO 0750-811x-xxxx-xxxx +9)
- [CVE-2026-103544](https://cve.now/CVE-2026-103544.md): datadrivenconstruction OpenConstructionERP Al Provider Configuration ai\_client.py wrong session (CVSS 5.3, datadrivenconstruction OpenConstructionERP)
- [CVE-2026-96255](https://cve.now/CVE-2026-96255.md): Payments for Hubtel \< 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log (CVSS 7.5, Payments for Hubtel)
- [CVE-2026-96200](https://cve.now/CVE-2026-96200.md): Payments for Hubtel \< 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback (CVSS 5.3, Payments for Hubtel)
- [CVE-2026-96173](https://cve.now/CVE-2026-96173.md): Payments for Hubtel \< 1.0.2 - Unauthenticated Order Key Disclosure via IDOR (CVSS 5.3, Payments for Hubtel)
- [CVE-2026-92412](https://cve.now/CVE-2026-92412.md): Five Star Restaurant Reviews \< 2.3.14 - Reflected XSS (CVSS 7.1, Five Star Restaurant Reviews)
- [CVE-2026-90974](https://cve.now/CVE-2026-90974.md): WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update (CVSS 6.5, WP Fusion Lite)
- [CVE-2026-90972](https://cve.now/CVE-2026-90972.md): WP Fusion Lite \< 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion (CVSS 5.4, WP Fusion Lite)
- [CVE-2026-89296](https://cve.now/CVE-2026-89296.md): Pro Like Button \< 2.0 - Unauthenticated SQLi via 'postid' Parameter (CVSS 8.6, Pro Like Button)
- [CVE-2026-87973](https://cve.now/CVE-2026-87973.md): If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name (CVSS 3.1, If-So Dynamic Content)
- [CVE-2026-87970](https://cve.now/CVE-2026-87970.md): If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render\_ifso\_shortcodes (CVSS 4.7, If-So Dynamic Content)
- [CVE-2026-86610](https://cve.now/CVE-2026-86610.md): Download Manager \< 3.3.71 - Author+ Stored XSS via Package Icon (CVSS 6.4, Download Manager)
- [CVE-2026-81809](https://cve.now/CVE-2026-81809.md): Paytm Payment Gateway \< 2.8.9 - Unauthenticated SQLi via Payment Callback (CVSS 7.5, Paytm Payment Gateway)
- [CVE-2026-81739](https://cve.now/CVE-2026-81739.md): Paytm Payment Gateway \< 2.8.9 - Unauthenticated Stored XSS via Payment Callback (CVSS 7.5, Paytm Payment Gateway)
- [CVE-2026-19253](https://cve.now/CVE-2026-19253.md): Cache Enabler \< 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache\_enabler\_clear\_page\_cache\_by\_url (CVSS 8.7, Cache Enabler)
- [CVE-2026-101148](https://cve.now/CVE-2026-101148.md): BackupSheep \<= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key (CVSS 10.0, BackupSheep WordPress Backup Plugin)
- [CVE-2026-101147](https://cve.now/CVE-2026-101147.md): Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF (CVSS 8.8, Featured Image from URL)
- [CVE-2026-103543](https://cve.now/CVE-2026-103543.md): itsourcecode Leave Management System controller.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-80275](https://cve.now/CVE-2026-80275.md): Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint (CVSS 8.8, Comelit Group S.p.A. 1456B Multi-User Gateway)
- [CVE-2026-80276](https://cve.now/CVE-2026-80276.md): Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface (CVSS 7.5, Comelit Group S.p.A. 1456B Multi-User Gateway)
- [CVE-2026-103542](https://cve.now/CVE-2026-103542.md): formtools.org Form Tools AJAX Endpoint actions.php smart\_fill server-side request forgery (CVSS 5.3, formtools.org Form Tools)
- [CVE-2026-88999](https://cve.now/CVE-2026-88999.md): Redux Framework \<= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment\_id' Parameter (CVSS 4.3, davidanderson Redux Framework)
- [CVE-2026-85679](https://cve.now/CVE-2026-85679.md): Extendify \<= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key (CVSS 7.2, Extendify)
- [CVE-2026-103541](https://cve.now/CVE-2026-103541.md): formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload (CVSS 5.3, formtools.org Form Tools)
- [CVE-2026-67075](https://cve.now/CVE-2026-67075.md): HCL Digital Experience is affected by improper input sanitation (CVSS 6.5, HCLSoftware Digital Experience)
- [CVE-2026-103540](https://cve.now/CVE-2026-103540.md): formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine (CVSS 5.3, formtools.org Form Tools)
- [CVE-2026-103539](https://cve.now/CVE-2026-103539.md): ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication (CVSS 5.3, ZongXR SuperMarket)
- [CVE-2026-82824](https://cve.now/CVE-2026-82824.md): Path traversal may allow arbitrary files to be viewed, created, modified, or deleted (CVSS 9.3, Hitachi Industrial Equipment Systems Hitachi Coding Softwar…)
- [CVE-2026-82825](https://cve.now/CVE-2026-82825.md): Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed (CVSS 9.3, Hitachi Industrial Equipment Systems Hitachi Coding Softwar…)
- [CVE-2026-82826](https://cve.now/CVE-2026-82826.md): Authentication information or sensitive data may be intercepted in transit (CVSS 8.7, Hitachi Industrial Equipment Systems Hitachi Coding Softwar…)
- [CVE-2026-82827](https://cve.now/CVE-2026-82827.md): A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens (CVSS 9.3, Hitachi Industrial Equipment Systems Hitachi Coding Softwar…)
- [CVE-2026-82828](https://cve.now/CVE-2026-82828.md): Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges (CVSS 8.7, Hitachi Industrial Equipment Systems Hitachi Coding Softwar…)
- [CVE-2026-82829](https://cve.now/CVE-2026-82829.md): Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process (CVSS 9.3, Hitachi Industrial Equipment Systems Hitachi Coding Softwar…)
- [CVE-2026-76147](https://cve.now/CVE-2026-76147.md): Genians, Inc Genian NAC/ZTNA Remote Code Execution (CVSS 5.9, Genians Genian NAC 4.0.175 Release · Genians Genian NAC… +7)
- [CVE-2026-76146](https://cve.now/CVE-2026-76146.md): Genians, Inc Genian SSL PNS OS Command Injection (CVSS 8.4, Genians Genian SSL PNS)
- [CVE-2026-76145](https://cve.now/CVE-2026-76145.md): Genians, Inc Genian SSL PNS Improper Privilege Management (CVSS 7.5, Genians Genian SSL PNS)
- [CVE-2026-76144](https://cve.now/CVE-2026-76144.md): Genians, Inc Genian SSL PNS Unrestricted File Upload (CVSS 1.8, Genians Genian SSL PNS)
- [CVE-2026-76143](https://cve.now/CVE-2026-76143.md): Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass (CVSS 7.3, Genians Genian SSL PNS)
- [CVE-2026-76142](https://cve.now/CVE-2026-76142.md): Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface (CVSS 9.3, Genians Genian NAC 5.0.75 LTS Release · Genians Genian N… +4)
- [CVE-2026-78210](https://cve.now/CVE-2026-78210.md): In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without (CVSS 7.1, Octopus Deploy Octopus Server)
- [CVE-2026-103538](https://cve.now/CVE-2026-103538.md): ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication (CVSS 6.9, ZongXR SuperMarket)
- [CVE-2026-92966](https://cve.now/CVE-2026-92966.md): Appointment Booking Plugin \<= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field (CVSS 9.1, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-12241](https://cve.now/CVE-2026-12241.md): Advanced Woo Labels – Product Labels & Badges for WooCommerce \<= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, mihail-barinov Advanced Woo Labels – Product Labels & Badge…)
- [CVE-2026-92548](https://cve.now/CVE-2026-92548.md): WP Popular Posts \<= 7.4.2 - Unauthenticated Information Disclosure in 'post\_type' and 'context' Parameters (CVSS 5.3, hcabrera WP Popular Posts)
- [CVE-2026-103536](https://cve.now/CVE-2026-103536.md): ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication (CVSS 6.9, ZongXR Supermarket)
- [CVE-2026-103641](https://cve.now/CVE-2026-103641.md): Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-103534](https://cve.now/CVE-2026-103534.md): David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control (CVSS 5.3, David-Crty databasement)
- [CVE-2026-91109](https://cve.now/CVE-2026-91109.md): Simply Schedule Appointments \<= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete\_group' Parameter (CVSS 6.5, croixhaug Simply Schedule Appointments)
- [CVE-2026-96561](https://cve.now/CVE-2026-96561.md): AI Engine \<= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model\_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection (CVSS 7.2, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2026-92245](https://cve.now/CVE-2026-92245.md): Simply Schedule Appointments \<= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment\_types REST Endpoint via Public Nonce (CVSS 7.5, croixhaug Simply Schedule Appointments)
- [CVE-2026-103533](https://cve.now/CVE-2026-103533.md): David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal (CVSS 2.1, David-Crty databasement)
- [CVE-2026-101887](https://cve.now/CVE-2026-101887.md): BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS (CVSS 2.1, arkq bluez-alsa)
- [CVE-2026-92537](https://cve.now/CVE-2026-92537.md): Newsletter \<= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure) (CVSS 5.3, satollo Newsletter – Send awesome emails from WordPress)
- [CVE-2026-13313](https://cve.now/CVE-2026-13313.md): An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass s (CVSS 8.9, ASUS Router)
- [CVE-2026-14157](https://cve.now/CVE-2026-14157.md): Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via (CVSS 9.4, ASUS Router)
- [CVE-2026-93495](https://cve.now/CVE-2026-93495.md): Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a (CVSS 7.0, ASUS Motherboard · ASUS Motherboard(ROG MAXIMUS XI HERO (WI…)
- [CVE-2026-103532](https://cve.now/CVE-2026-103532.md): immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization (CVSS 6.9, immich-app Immich)
- [CVE-2026-103531](https://cve.now/CVE-2026-103531.md): OpenSC card-setcos.c setcos\_construct\_fci\_44 stack-based overflow (CVSS 5.1, OpenSC)
- [CVE-2026-51873](https://cve.now/CVE-2026-51873.md): Devika v1.0 is vulnerable to Directory Traversal in the Coder.save\_code\_to\_project function, which allows attackers to write files outside t (CVSS 8.8)
- [CVE-2026-51874](https://cve.now/CVE-2026-51874.md): In Devika v1.0, the Patcher Agent save\_code\_to\_project function contains a path traversal vulnerability that allows attackers to write files (CVSS 7.5)
- [CVE-2026-51875](https://cve.now/CVE-2026-51875.md): In Devika v1.0, the Feature Agent save\_code\_to\_project function contains a path traversal vulnerability that allows attackers to write files (CVSS 9.1)
- [CVE-2026-51876](https://cve.now/CVE-2026-51876.md): DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. (CVSS 9.1)
- [CVE-2026-51878](https://cve.now/CVE-2026-51878.md): deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate\_last\_turn. (CVSS 4.3)
- [CVE-2026-51879](https://cve.now/CVE-2026-51879.md): deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write\_bot\_file. (CVSS 9.1)
- [CVE-2026-51880](https://cve.now/CVE-2026-51880.md): deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. (CVSS 9.8)
- [CVE-2026-51881](https://cve.now/CVE-2026-51881.md): deeptutor 1.4.0 contains code injection in ExecTool.execute. (CVSS 9.8)
- [CVE-2026-51882](https://cve.now/CVE-2026-51882.md): The OpenAI-compatible file upload endpoint \`/v1/files\` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. (CVSS 9.1)
- [CVE-2026-51883](https://cve.now/CVE-2026-51883.md): The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. (CVSS 9.1)
- [CVE-2026-51884](https://cve.now/CVE-2026-51884.md): The /knowledge\_base/upload\_temp\_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. (CVSS 9.8)
- [CVE-2026-51886](https://cve.now/CVE-2026-51886.md): langflow-ai langflow v1.9.3 is affected by: Code Injection. (CVSS 9.8, langflow)
- [CVE-2026-51888](https://cve.now/CVE-2026-51888.md): langflow-ai langflow v1.8.4 is affected by: Directory Traversal. (CVSS 7.5)
- [CVE-2026-51892](https://cve.now/CVE-2026-51892.md): infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/\<doc\_id\>. (CVSS 6.5)
- [CVE-2026-51893](https://cve.now/CVE-2026-51893.md): infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace\_mindmap. (CVSS 9.8)
- [CVE-2026-51894](https://cve.now/CVE-2026-51894.md): infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run\_mindmap. (CVSS 6.5)
- [CVE-2026-51895](https://cve.now/CVE-2026-51895.md): Ragflow 0.24.0 and prior contains improper access control in update\_metadata\_setting (api/apps/kb\_app.py). (CVSS 6.5)
- [CVE-2026-51896](https://cve.now/CVE-2026-51896.md): infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector\_app.py). (CVSS 6.5)
- [CVE-2026-51897](https://cve.now/CVE-2026-51897.md): RAGFlow 0.24.0 contains improper access control in get\_dataset (api/apps/evaluation\_app). (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.