# CVEs published 2026-10-02

398 CVEs were published on October 2, 2026: 41 critical, 187 high. Days are UTC.

- [CVE-2026-105030](https://cve.now/CVE-2026-105030.md): Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API (CVSS 6.9, rajnandan1 kener)
- [CVE-2026-105029](https://cve.now/CVE-2026-105029.md): UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint (CVSS 5.3, uvdesk support-center-bundle · uvdesk community-skeleton)
- [CVE-2026-104479](https://cve.now/CVE-2026-104479.md): Shopclass before 6.2.0 Stored XSS via Listing Description Field (CVSS 5.1, mindstellar shopclass)
- [CVE-2026-104478](https://cve.now/CVE-2026-104478.md): Formwork before 2.3.13 Path Traversal via BackupController Download and Delete (CVSS 7.1, getformwork formwork)
- [CVE-2026-104477](https://cve.now/CVE-2026-104477.md): Showdown through 2.1.0 XSS via unescaped quote in href and src attributes (CVSS 5.3, showdownjs showdown)
- [CVE-2026-104476](https://cve.now/CVE-2026-104476.md): Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive (CVSS 8.2, backdrop)
- [CVE-2026-104475](https://cve.now/CVE-2026-104475.md): IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload (CVSS 5.1, idurar-erp-crm)
- [CVE-2026-104474](https://cve.now/CVE-2026-104474.md): OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update (CVSS 5.4, litespeedtech openlitespeed)
- [CVE-2026-104433](https://cve.now/CVE-2026-104433.md): Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString (CVSS 8.7, kvcache-ai Mooncake)
- [CVE-2026-105051](https://cve.now/CVE-2026-105051.md): Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys (CVSS 1.9, Irdeto Denuvo Anti-Tamper)
- [CVE-2026-105050](https://cve.now/CVE-2026-105050.md): PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation (CVSS 7.1, PeaZip)
- [CVE-2026-105049](https://cve.now/CVE-2026-105049.md): Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URL (CVSS 5.8, Zilliz Attu)
- [CVE-2026-84411](https://cve.now/CVE-2026-84411.md): MikroTik RouterOS Integer Underflow (CVSS 9.8, MikroTik RouterOS)
- [CVE-2026-105048](https://cve.now/CVE-2026-105048.md): The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses). (CVSS 4.0, Zilliz Attu)
- [CVE-2026-94591](https://cve.now/CVE-2026-94591.md): Armatura LLC Armatura One Use of Hard-coded Cryptographic Key (CVSS 8.4, Armatura One)
- [CVE-2026-94592](https://cve.now/CVE-2026-94592.md): Armatura LLC Armatura One Use of Hard-coded Credentials (CVSS 8.4, Armatura One)
- [CVE-2026-105046](https://cve.now/CVE-2026-105046.md): Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints. (CVSS 4.3, Kentico Xperience)
- [CVE-2026-94593](https://cve.now/CVE-2026-94593.md): Armatura LLC Armatura One Insertion of Sensitive Information into Log File (CVSS 7.8, Armatura One)
- [CVE-2026-94594](https://cve.now/CVE-2026-94594.md): Armatura LLC Armatura One Insertion of Sensitive Information into Log File (CVSS 4.0, Armatura One)
- [CVE-2026-95102](https://cve.now/CVE-2026-95102.md): Monta monta.app Missing Authentication for Critical Function (CVSS 9.4, monta.app)
- [CVE-2026-105043](https://cve.now/CVE-2026-105043.md): MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will c (CVSS 3.6, MathWorks Simulink)
- [CVE-2026-97363](https://cve.now/CVE-2026-97363.md): Monta monta.app Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, monta.app)
- [CVE-2026-97212](https://cve.now/CVE-2026-97212.md): Monta monta.app Insufficient Session Expiration (CVSS 7.3, monta.app)
- [CVE-2026-93474](https://cve.now/CVE-2026-93474.md): Monta monta.app Insufficiently Protected Credentials (CVSS 6.5, monta.app)
- [CVE-2026-104055](https://cve.now/CVE-2026-104055.md): Monitoring-user password logged in cleartext by postgres\_exporter in postgresql VM charm (CVSS 5.3, Canonical postgresql-operator)
- [CVE-2026-75937](https://cve.now/CVE-2026-75937.md): OS Command Injection in Digi Accelerated Linux (DAL OS) (CVSS 9.4, Digi International IX Family · Digi International EX Fa… +10)
- [CVE-2026-82045](https://cve.now/CVE-2026-82045.md): UTMStack \< 11.2.16 JPQL Injection via searchPropertyValues (CVSS 7.1, UTMStack)
- [CVE-2026-104874](https://cve.now/CVE-2026-104874.md): Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction (CVSS 5.3, aio-libs multidict · multidict)
- [CVE-2026-82044](https://cve.now/CVE-2026-82044.md): UTMStack \< 11.2.16 Server-Side Request Forgery via downloadPdf (CVSS 6.3, UTMStack)
- [CVE-2026-82043](https://cve.now/CVE-2026-82043.md): UTMStack \< 11.2.16 Account Enumeration via Password Reset Endpoint (CVSS 6.9, UTMStack)
- [CVE-2026-82042](https://cve.now/CVE-2026-82042.md): UTMStack \< 11.2.16 Authentication Bypass via InternalApiKeyFilter (CVSS 9.3, UTMStack)
- [CVE-2026-82041](https://cve.now/CVE-2026-82041.md): UTMStack \< 11.2.16 Missing Authorization via Command WebSocket (CVSS 6.5, UTMStack)
- [CVE-2026-104019](https://cve.now/CVE-2026-104019.md): OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio (CVSS 9.0, AWS sagemaker-distribution)
- [CVE-2026-104873](https://cve.now/CVE-2026-104873.md): LangGraph SDK custom auth silently ignores actions= on resource decorators (CVSS 7.6, langchain-ai langgraph · langgraph-sdk)
- [CVE-2026-103918](https://cve.now/CVE-2026-103918.md): @orpc/zod: Prototype injection in smart coercion (CVSS 6.5, middleapi orpc · @orpc/zod)
- [CVE-2026-82040](https://cve.now/CVE-2026-82040.md): UTMStack \< 11.2.16 SSRF via IdentityProviderService (CVSS 5.3, UTMStack)
- [CVE-2026-103036](https://cve.now/CVE-2026-103036.md): @orpc/json-schema: Prototype injection in smart coercion (CVSS 6.5, middleapi orpc)
- [CVE-2026-82039](https://cve.now/CVE-2026-82039.md): UTMStack \< 11.2.16 SQL Injection via searchGroupsByFilter (CVSS 8.7, UTMStack)
- [CVE-2026-104994](https://cve.now/CVE-2026-104994.md): Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. (CVSS 2.5, aquasec Trivy)
- [CVE-2026-104872](https://cve.now/CVE-2026-104872.md): Multiple @opentelemetry/instrumentation-\* packages expose database username via unconditional db.user span attribute (CVSS 5.8, open-telemetry opentelemetry-js-contrib · @opentelemetr… +15)
- [CVE-2026-104871](https://cve.now/CVE-2026-104871.md): Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows (CVSS 6.3, angular-cli · @angular/ssr)
- [CVE-2026-104988](https://cve.now/CVE-2026-104988.md): Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject (CVSS 8.1, Red Hat Certificate System · Red Hat Enterprise Linux)
- [CVE-2026-104991](https://cve.now/CVE-2026-104991.md): Phproject \< 1.8.7 Missing Authorization via Issues REST API (CVSS 7.1, Alanaktion phproject)
- [CVE-2026-12392](https://cve.now/CVE-2026-12392.md): RPC secret disclosure via vendor data endpoint in Canonical MAAS (CVSS 5.3, Canonical MAAS)
- [CVE-2026-39718](https://cve.now/CVE-2026-39718.md): WordPress Wallstreet theme \<= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Webriti Wallstreet)
- [CVE-2026-103958](https://cve.now/CVE-2026-103958.md): Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS (CVSS 7.6, AWS loom)
- [CVE-2026-103957](https://cve.now/CVE-2026-103957.md): Server-side request forgery in the OAuth2 discovery handling in Loom for AWS (CVSS 6.2, AWS loom)
- [CVE-2026-96940](https://cve.now/CVE-2026-96940.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-103956](https://cve.now/CVE-2026-103956.md): Missing authentication for critical function in Loom for AWS (CVSS 10.0, AWS loom)
- [CVE-2020-37278](https://cve.now/CVE-2020-37278.md): Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile (CVSS 8.7, Weaver e-Bridge)
- [CVE-2014-125130](https://cve.now/CVE-2014-125130.md): CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct\_download.php (CVSS 8.7, Damjan CodeArt Google MP3 Audio Player)
- [CVE-2023-54405](https://cve.now/CVE-2023-54405.md): H3C CVM Unauthenticated File Upload via fileUpload/upload Token (CVSS 9.3, H3C CVM)
- [CVE-2026-19856](https://cve.now/CVE-2026-19856.md): All in One SEO \< 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query (CVSS 6.5, All in One SEO)
- [CVE-2026-104861](https://cve.now/CVE-2026-104861.md): probe-image-size: Quadratic-time Denial of Service in the SVG Parser (CVSS 7.5, nodeca probe-image-size · probe-image-size)
- [CVE-2026-104859](https://cve.now/CVE-2026-104859.md): Nx: OS command injection in the @nx/docker release pipeline (CVSS 7.3, nrwl nx · @nx/docker)
- [CVE-2026-102795](https://cve.now/CVE-2026-102795.md): Apache Traffic Server: SNI to Host header matching policy is not properly enforced (CVSS 9.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2026-104855](https://cve.now/CVE-2026-104855.md): Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state (CVSS 2.0, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-59265](https://cve.now/CVE-2026-59265.md): Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover (CVSS 8.8, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-102626](https://cve.now/CVE-2026-102626.md): LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date\_min question attribute (CVSS 7.2, LimeSurvey)
- [CVE-2026-104854](https://cve.now/CVE-2026-104854.md): Nx daemon and plugin worker sockets are accessible to other local users (CVSS 8.5, nrwl nx · nx)
- [CVE-2026-104853](https://cve.now/CVE-2026-104853.md): Nx: Path traversal in nx migrate package-migrations extraction (CVSS 5.8, nrwl nx · nx)
- [CVE-2026-104851](https://cve.now/CVE-2026-104851.md): fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution (CVSS 8.8, fsspec filesystem\_spec · fsspec)
- [CVE-2026-104849](https://cve.now/CVE-2026-104849.md): Tinypool: Prototype Pollution Gadget to RCE in run() options (CVSS 9.5, tinylibs tinypool · tinypool)
- [CVE-2026-104848](https://cve.now/CVE-2026-104848.md): Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution (CVSS 9.5, tinylibs tinypool · tinypool)
- [CVE-2026-104914](https://cve.now/CVE-2026-104914.md): MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View (CVSS 5.3, MISP)
- [CVE-2026-103627](https://cve.now/CVE-2026-103627.md): Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML (CVSS 6.5, Google Chrome)
- [CVE-2026-103631](https://cve.now/CVE-2026-103631.md): Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-103623](https://cve.now/CVE-2026-103623.md): Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-103622](https://cve.now/CVE-2026-103622.md): Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-103629](https://cve.now/CVE-2026-103629.md): Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page (CVSS 4.3, Google Chrome)
- [CVE-2026-103624](https://cve.now/CVE-2026-103624.md): Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the r (CVSS 8.3, Google Chrome)
- [CVE-2026-103625](https://cve.now/CVE-2026-103625.md): Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-103630](https://cve.now/CVE-2026-103630.md): Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via (CVSS 9.6, Google Chrome)
- [CVE-2026-103621](https://cve.now/CVE-2026-103621.md): Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HT (CVSS 4.3, Google Chrome)
- [CVE-2026-103626](https://cve.now/CVE-2026-103626.md): Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engi (CVSS 9.6, Google Chrome)
- [CVE-2026-103628](https://cve.now/CVE-2026-103628.md): Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox (CVSS 9.6, Google Chrome)
- [CVE-2026-103648](https://cve.now/CVE-2026-103648.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader (CVSS 9.1, demsking image-downloader)
- [CVE-2026-104912](https://cve.now/CVE-2026-104912.md): MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data (CVSS 7.1, MISP)
- [CVE-2026-96613](https://cve.now/CVE-2026-96613.md): Missing Authorization in Meari IoT Cloud Platform OpenAPI Service (CVSS 7.1, Meari IoT Cloud Platform OpenAPI Service)
- [CVE-2026-104847](https://cve.now/CVE-2026-104847.md): ProseMirror: XSS vulnerability in prosemirror-view's paste handling (CVSS 8.5, prosemirror-view)
- [CVE-2026-104910](https://cve.now/CVE-2026-104910.md): MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization (CVSS 5.3, MISP)
- [CVE-2026-104846](https://cve.now/CVE-2026-104846.md): Seroval: \`fromJSON()\` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) (CVSS 9.8, lxsmnsyc seroval · seroval)
- [CVE-2026-101104](https://cve.now/CVE-2026-101104.md): Missing Authorization in Meari IoT Cloud Platform OpenAPI Service (CVSS 6.3, Meari IoT Cloud Platform OpenAPI Service)
- [CVE-2026-104908](https://cve.now/CVE-2026-104908.md): MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging (CVSS 7.1, MISP)
- [CVE-2026-104845](https://cve.now/CVE-2026-104845.md): Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization (CVSS 7.5, lxsmnsyc seroval · seroval)
- [CVE-2026-104907](https://cve.now/CVE-2026-104907.md): MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler (CVSS 4.8, MISP)
- [CVE-2026-104906](https://cve.now/CVE-2026-104906.md): MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output (CVSS 6.2, MISP)
- [CVE-2026-104844](https://cve.now/CVE-2026-104844.md): PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion (CVSS 5.9, postcss-selector-parser)
- [CVE-2026-104843](https://cve.now/CVE-2026-104843.md): uv: Path traversal on Windows through wheel extraction (CVSS 5.9, astral-sh uv · uv)
- [CVE-2026-94484](https://cve.now/CVE-2026-94484.md): Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service (CVSS 6.3, vercel next.js · next)
- [CVE-2026-94485](https://cve.now/CVE-2026-94485.md): Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass (CVSS 6.3, vercel next.js · next)
- [CVE-2026-104901](https://cve.now/CVE-2026-104901.md): MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server (CVSS 5.1, MISP)
- [CVE-2026-94483](https://cve.now/CVE-2026-94483.md): Next.js: Server-Side Request Forgery in Image Optimization (CVSS 8.3, vercel next.js · next)
- [CVE-2026-94543](https://cve.now/CVE-2026-94543.md): Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications (CVSS 6.3, vercel next.js · next)
- [CVE-2026-104900](https://cve.now/CVE-2026-104900.md): MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index (CVSS 5.3, MISP)
- [CVE-2026-94544](https://cve.now/CVE-2026-94544.md): Next.js: Pending \`use cache\` fill can leak Draft Mode content into regular responses and persisted pages (CVSS 6.3, vercel next.js · next)
- [CVE-2026-94486](https://cve.now/CVE-2026-94486.md): Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint (CVSS 2.3, vercel next.js · next)
- [CVE-2026-104638](https://cve.now/CVE-2026-104638.md): onetwothreeneth HospitalManagementSystem sessions.php improper authentication (CVSS 6.9, onetwothreeneth HospitalManagementSystem)
- [CVE-2026-39717](https://cve.now/CVE-2026-39717.md): WordPress LearnPress plugin \<= 4.4.10 - Broken Access Control vulnerability (CVSS 4.3, ThimPress LearnPress)
- [CVE-2026-39601](https://cve.now/CVE-2026-39601.md): WordPress Booking Calendar plugin \<= 11.8.4 - Race Condition vulnerability (CVSS 3.7, WPdevelop Booking Calendar)
- [CVE-2026-39600](https://cve.now/CVE-2026-39600.md): WordPress Aculect AI Companion plugin \<= 0.8.2 - Unvalidated Redirects and Forwards vulnerability (CVSS 4.7, Mehul Gohil Aculect AI Companion)
- [CVE-2026-39444](https://cve.now/CVE-2026-39444.md): WordPress PublishPress Series plugin \<= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, PublishPress Series)
- [CVE-2026-104637](https://cve.now/CVE-2026-104637.md): onetwothreeneth HospitalManagementSystem controller.php edit\_patient unrestricted upload (CVSS 6.9, onetwothreeneth HospitalManagementSystem)
- [CVE-2026-39439](https://cve.now/CVE-2026-39439.md): WordPress WebSamurai plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 6.5, Kiera Howe WebSamurai)
- [CVE-2026-32585](https://cve.now/CVE-2026-32585.md): WordPress Airano MCP Bridge plugin \<= 2.11.0 - Broken Access Control vulnerability (CVSS 6.5, Airano MCP Bridge)
- [CVE-2026-32584](https://cve.now/CVE-2026-32584.md): WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin \<= 1.4.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Chiranjit Hazarika Smart One Click Setup – Complete Demo Im…)
- [CVE-2026-90970](https://cve.now/CVE-2026-90970.md): Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway (CVSS 9.9, GitLab AI Gateway)
- [CVE-2026-104625](https://cve.now/CVE-2026-104625.md): CodeAstro Simple Loan Management System index.php sql injection (CVSS 5.3, CodeAstro Simple Loan Management System)
- [CVE-2026-5782](https://cve.now/CVE-2026-5782.md): Reflected XSS in MRV Technology's TurkHotspot (CVSS 5.2, MRV Technology Foreign Trade Ltd. TurkHotspot)
- [CVE-2026-104026](https://cve.now/CVE-2026-104026.md): In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. (CVSS 7.8, Meta Platforms Sapling SCM)
- [CVE-2026-104614](https://cve.now/CVE-2026-104614.md): CodeAstro Simple Pharmacy Management System delete.php sql injection (CVSS 5.3, CodeAstro Simple Pharmacy Management System)
- [CVE-2026-94422](https://cve.now/CVE-2026-94422.md): xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVSS 8.8, xdg-dbus-proxy · Fedora +1)
- [CVE-2026-19652](https://cve.now/CVE-2026-19652.md): Divi Membership \<= 2.2.0 - Unauthenticated Privilege Escalation via 'form\_id' Parameter (CVSS 9.8, DiviEngine Divi Membership)
- [CVE-2026-93875](https://cve.now/CVE-2026-93875.md): JetAppointment \<= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter (CVSS 7.2, Crocoblock JetAppointment)
- [CVE-2026-104721](https://cve.now/CVE-2026-104721.md): Logback: Incomplete protection against CVE-2026-19880 (CVSS 6.3, QOS.CH Sarl Logback-classic)
- [CVE-2026-104613](https://cve.now/CVE-2026-104613.md): CodeAstro Simple Pharmacy Management System view.php sql injection (CVSS 5.3, CodeAstro Simple Pharmacy Management System)
- [CVE-2026-85215](https://cve.now/CVE-2026-85215.md): SQL Injection in GG Soft's Paperwork (CVSS 7.1, GG Soft Software Services Paperwork)
- [CVE-2026-66054](https://cve.now/CVE-2026-66054.md): Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize (CVSS 6.9, Apache Software Foundation Apache Thrift)
- [CVE-2026-61374](https://cve.now/CVE-2026-61374.md): Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit (CVSS 7.1, Apache Software Foundation Apache Thrift)
- [CVE-2026-63772](https://cve.now/CVE-2026-63772.md): Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-66055](https://cve.now/CVE-2026-66055.md): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language) (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-104612](https://cve.now/CVE-2026-104612.md): SourceCodester Student Result Management System Announcement new\_announcement.php cross site scripting (CVSS 5.3, SourceCodester Student Result Management System)
- [CVE-2026-11795](https://cve.now/CVE-2026-11795.md): User Enumeration in Softtr's E-Commerce Pack (CVSS 5.3, Softtr Informatics Trading Limited Company E-Commerce Pack)
- [CVE-2026-102797](https://cve.now/CVE-2026-102797.md): WordPress ThemeREX Addons plugin \<= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, ThemeREX Group ThemeREX Addons)
- [CVE-2026-102798](https://cve.now/CVE-2026-102798.md): WordPress ThemeREX Addons plugin \<= 2.46.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeREX Group ThemeREX Addons)
- [CVE-2026-66081](https://cve.now/CVE-2026-66081.md): Apache Thrift: c\_glib read\_message\_begin leaves output parameters unset for non-versioned messages (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-66331](https://cve.now/CVE-2026-66331.md): Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize (CVSS 6.9, Apache Software Foundation Apache Thrift)
- [CVE-2026-66837](https://cve.now/CVE-2026-66837.md): Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-66858](https://cve.now/CVE-2026-66858.md): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml) (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-66859](https://cve.now/CVE-2026-66859.md): Apache Thrift: c\_glib multiplexed processor crashes on a message it cannot route (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-83632](https://cve.now/CVE-2026-83632.md): Apache Thrift: C++ THttpTransport grows its line buffer without bound (CVSS 9.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-104733](https://cve.now/CVE-2026-104733.md): User Impersonation/Authorization Bypass in XMPP Server ejabberd (CVSS 7.4, ProcessOne ejabberd)
- [CVE-2026-83663](https://cve.now/CVE-2026-83663.md): Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go) (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-83745](https://cve.now/CVE-2026-83745.md): Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D) (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-104611](https://cve.now/CVE-2026-104611.md): Tenda AC9 POST Request fast\_setting\_internet\_set stack-based overflow (CVSS 9.4, Tenda AC9)
- [CVE-2026-85476](https://cve.now/CVE-2026-85476.md): Apache Thrift: c\_glib \`read\_all\` spins when the underlying read returns 0 (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-96289](https://cve.now/CVE-2026-96289.md): Apache Thrift: php \`--gen php:inlined\` struct readers (and \`TProtocol::skipBinary\`) have no recursion-depth guard (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-96287](https://cve.now/CVE-2026-96287.md): Apache Thrift: Perl \`FramedTransport\` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-96286](https://cve.now/CVE-2026-96286.md): Apache Thrift: Perl servers end \`serve()\` when serving one connection fails (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-96277](https://cve.now/CVE-2026-96277.md): Apache Thrift: Ruby \`SimpleServer\` ends \`serve()\` on any non-Transport/Protocol exception (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-94658](https://cve.now/CVE-2026-94658.md): Apache Thrift: Lua \`TFramedTransport\`/\`THttpTransport\` re-slice the buffer on every read (quadratic) (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-94657](https://cve.now/CVE-2026-94657.md): Apache Thrift: javame \`TJsonProtocol\`/\`TJSONProtocol\` has no string size bound (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94656](https://cve.now/CVE-2026-94656.md): Apache Thrift: rb \`TJsonProtocol\`/\`TJSONProtocol\` has no string size bound (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-104610](https://cve.now/CVE-2026-104610.md): Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow (CVSS 10.0, Tenda HG7 · Tenda HG9 +1)
- [CVE-2026-94655](https://cve.now/CVE-2026-94655.md): Apache Thrift: Lua \`TJsonProtocol\` string/number readers have no size bound and are quadratic (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94654](https://cve.now/CVE-2026-94654.md): Apache Thrift: Python \`TNonblockingServer\` busy-loops and stops selecting all fds after an 8192-byte-boundary frame (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-85209](https://cve.now/CVE-2026-85209.md): IDOR in AVEZ Electronics's LMS (CVSS 6.5, AVEZ Electronics Communication Training and Consultancy Tra…)
- [CVE-2026-94653](https://cve.now/CVE-2026-94653.md): Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94652](https://cve.now/CVE-2026-94652.md): Apache Thrift: C++ \`TEvhttpServer\` leaks its \`RequestContext\` when the processor throws before calling back (CVSS 6.3, Apache Software Foundation Apache Thrift)
- [CVE-2026-94648](https://cve.now/CVE-2026-94648.md): Apache Thrift: dart \`TJsonProtocol\`/\`TJSONProtocol\` has no string size bound (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94646](https://cve.now/CVE-2026-94646.md): Apache Thrift: Node.js \`server.js\` ends the process on any per-connection error (+ two triggers) (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-94638](https://cve.now/CVE-2026-94638.md): Apache Thrift: PHP \`thrift\_protocol\` C extension ignores the configured \`maxStringSize\` (CVSS 6.3, Apache Software Foundation Apache Thrift)
- [CVE-2026-94637](https://cve.now/CVE-2026-94637.md): Apache Thrift: Go \`THeaderTransport\` does not bound the inflated size of a ZLIB frame (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94636](https://cve.now/CVE-2026-94636.md): Apache Thrift: Python \`TZlibTransport\` stops enforcing its decompressed-size limit once the limit is exactly used up (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-92834](https://cve.now/CVE-2026-92834.md): Apache Thrift: C++ WebSocket server transport does not read a full request length (CVSS 6.3, Apache Software Foundation Apache Thrift)
- [CVE-2026-104609](https://cve.now/CVE-2026-104609.md): onetwothreeneth HospitalManagementSystem edit\_accounts.php get sql injection (CVSS 6.9, onetwothreeneth HospitalManagementSystem)
- [CVE-2026-90440](https://cve.now/CVE-2026-90440.md): Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-87117](https://cve.now/CVE-2026-87117.md): Apache Thrift: PHP \`thrift\_protocol\` accelerator dereferences a missing container-element spec (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-86537](https://cve.now/CVE-2026-86537.md): Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-86536](https://cve.now/CVE-2026-86536.md): Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript (CVSS 6.3, Apache Software Foundation Apache Thrift)
- [CVE-2026-104473](https://cve.now/CVE-2026-104473.md): YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages (CVSS 5.1, yeswiki · yeswiki/yeswiki)
- [CVE-2026-104472](https://cve.now/CVE-2026-104472.md): YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler (CVSS 8.7, yeswiki)
- [CVE-2026-104471](https://cve.now/CVE-2026-104471.md): YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import (CVSS 8.6, yeswiki)
- [CVE-2026-104470](https://cve.now/CVE-2026-104470.md): YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter (CVSS 5.3, yeswiki)
- [CVE-2026-104469](https://cve.now/CVE-2026-104469.md): YesWiki before 4.6.7 Session Fixation via Login in AuthController.php (CVSS 7.6, yeswiki)
- [CVE-2026-104468](https://cve.now/CVE-2026-104468.md): YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction (CVSS 6.3, yeswiki)
- [CVE-2026-104467](https://cve.now/CVE-2026-104467.md): YesWiki before 4.6.7 Authorization Bypass via Public API Mode (CVSS 9.2, yeswiki)
- [CVE-2026-104466](https://cve.now/CVE-2026-104466.md): YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute (CVSS 5.1, yeswiki)
- [CVE-2026-104465](https://cve.now/CVE-2026-104465.md): YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler (CVSS 5.1, yeswiki)
- [CVE-2026-104464](https://cve.now/CVE-2026-104464.md): YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter (CVSS 8.8, yeswiki)
- [CVE-2026-104463](https://cve.now/CVE-2026-104463.md): YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox (CVSS 8.3, yeswiki)
- [CVE-2026-104462](https://cve.now/CVE-2026-104462.md): YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter (CVSS 8.8, yeswiki)
- [CVE-2026-104461](https://cve.now/CVE-2026-104461.md): YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField (CVSS 5.1, yeswiki)
- [CVE-2026-104460](https://cve.now/CVE-2026-104460.md): YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch (CVSS 8.7, yeswiki)
- [CVE-2026-104459](https://cve.now/CVE-2026-104459.md): YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor\_handle (CVSS 6.9, yeswiki)
- [CVE-2026-104458](https://cve.now/CVE-2026-104458.md): YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses (CVSS 8.3, yeswiki)
- [CVE-2026-104457](https://cve.now/CVE-2026-104457.md): YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter (CVSS 8.8, yeswiki)
- [CVE-2026-104456](https://cve.now/CVE-2026-104456.md): YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username (CVSS 7.2, yeswiki)
- [CVE-2026-104455](https://cve.now/CVE-2026-104455.md): YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action (CVSS 6.9, yeswiki)
- [CVE-2026-104454](https://cve.now/CVE-2026-104454.md): YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint (CVSS 6.9, yeswiki)
- [CVE-2026-104453](https://cve.now/CVE-2026-104453.md): YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action (CVSS 5.3, yeswiki)
- [CVE-2026-104452](https://cve.now/CVE-2026-104452.md): YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler (CVSS 5.3, yeswiki)
- [CVE-2026-104451](https://cve.now/CVE-2026-104451.md): YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler (CVSS 5.3, yeswiki)
- [CVE-2026-104450](https://cve.now/CVE-2026-104450.md): YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action (CVSS 8.2, yeswiki)
- [CVE-2026-104449](https://cve.now/CVE-2026-104449.md): YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id\_fiche (CVSS 8.3, yeswiki)
- [CVE-2026-104448](https://cve.now/CVE-2026-104448.md): YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler (CVSS 7.2, yeswiki)
- [CVE-2026-104447](https://cve.now/CVE-2026-104447.md): YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction (CVSS 7.1, yeswiki)
- [CVE-2026-104446](https://cve.now/CVE-2026-104446.md): YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler (CVSS 6.9, yeswiki)
- [CVE-2026-104445](https://cve.now/CVE-2026-104445.md): YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing (CVSS 8.8, yeswiki)
- [CVE-2026-104444](https://cve.now/CVE-2026-104444.md): YesWiki before 4.6.7 Authorization Bypass via Comments API editComment (CVSS 7.1, yeswiki)
- [CVE-2026-104443](https://cve.now/CVE-2026-104443.md): YesWiki before 4.6.7 Scope Bypass via Triples Delete API (CVSS 7.2, yeswiki)
- [CVE-2026-104442](https://cve.now/CVE-2026-104442.md): YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action (CVSS 6.9, yeswiki)
- [CVE-2026-86535](https://cve.now/CVE-2026-86535.md): Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-104441](https://cve.now/CVE-2026-104441.md): YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action (CVSS 6.9, yeswiki)
- [CVE-2026-104440](https://cve.now/CVE-2026-104440.md): YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter (CVSS 6.9, yeswiki)
- [CVE-2026-104439](https://cve.now/CVE-2026-104439.md): YesWiki before 4.6.7 User Enumeration via Lost-Password Flow (CVSS 7.1, yeswiki)
- [CVE-2026-104438](https://cve.now/CVE-2026-104438.md): YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions (CVSS 8.7, yeswiki)
- [CVE-2026-104437](https://cve.now/CVE-2026-104437.md): Zebra before 4.4.0 Consensus Split via SIGHASH\_SINGLE Missing-Output Handling (CVSS 8.3, ZcashFoundation zebra · zebrad)
- [CVE-2026-104436](https://cve.now/CVE-2026-104436.md): Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length (CVSS 6.3, ZcashFoundation zebra · ZcashFoundation zebra-chain +2)
- [CVE-2026-104435](https://cve.now/CVE-2026-104435.md): Zebra 4.4.0 Consensus Divergence via V5 SIGHASH\_SINGLE Without Output (CVSS 8.3, ZcashFoundation zebra · zebrad +1)
- [CVE-2026-104434](https://cve.now/CVE-2026-104434.md): Zebra before 8.0.0 Denial of Service via z\_listunifiedreceivers RPC (CVSS 7.1, ZcashFoundation zebra · zebra-rpc +1)
- [CVE-2026-104432](https://cve.now/CVE-2026-104432.md): Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response (CVSS 6.9, ZcashFoundation zebra)
- [CVE-2026-104431](https://cve.now/CVE-2026-104431.md): Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification (CVSS 8.7, ZcashFoundation zebra)
- [CVE-2026-104430](https://cve.now/CVE-2026-104430.md): Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount (CVSS 8.7, ZcashFoundation zebra)
- [CVE-2026-104429](https://cve.now/CVE-2026-104429.md): Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages (CVSS 6.9, ZcashFoundation zebra)
- [CVE-2026-104428](https://cve.now/CVE-2026-104428.md): Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 (CVSS 6.9, ZcashFoundation zebra)
- [CVE-2026-104427](https://cve.now/CVE-2026-104427.md): Zebra before 6.1.0 Chain Stall via Stale parent\_error\_map Entry (CVSS 8.2, ZcashFoundation zebra)
- [CVE-2026-104426](https://cve.now/CVE-2026-104426.md): Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check (CVSS 8.2, ZcashFoundation zebra)
- [CVE-2026-104425](https://cve.now/CVE-2026-104425.md): Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions (CVSS 6.9, ZcashFoundation zebra)
- [CVE-2026-104424](https://cve.now/CVE-2026-104424.md): Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate (CVSS 6.3, ZcashFoundation zebra)
- [CVE-2026-104423](https://cve.now/CVE-2026-104423.md): Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification (CVSS 8.7, ZcashFoundation zebra)
- [CVE-2026-104422](https://cve.now/CVE-2026-104422.md): Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite (CVSS 8.7, ZcashFoundation zebra)
- [CVE-2026-104421](https://cve.now/CVE-2026-104421.md): Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout (CVSS 6.9, ZcashFoundation zebra)
- [CVE-2026-104420](https://cve.now/CVE-2026-104420.md): Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks (CVSS 6.9, ZcashFoundation zebra)
- [CVE-2026-104419](https://cve.now/CVE-2026-104419.md): Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes (CVSS 6.3, ZcashFoundation zebra)
- [CVE-2026-104418](https://cve.now/CVE-2026-104418.md): Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files (CVSS 8.6, TryGhost Ghost · ghost)
- [CVE-2026-104417](https://cve.now/CVE-2026-104417.md): Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting (CVSS 6.9, TryGhost Ghost · ghost)
- [CVE-2026-104416](https://cve.now/CVE-2026-104416.md): Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API (CVSS 7.7, TryGhost Ghost · ghost)
- [CVE-2026-104415](https://cve.now/CVE-2026-104415.md): Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API (CVSS 2.3, TryGhost Ghost · ghost)
- [CVE-2026-104414](https://cve.now/CVE-2026-104414.md): Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses (CVSS 8.6, TryGhost Ghost · ghost)
- [CVE-2026-104413](https://cve.now/CVE-2026-104413.md): Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images (CVSS 8.5, TryGhost Ghost · ghost)
- [CVE-2026-104412](https://cve.now/CVE-2026-104412.md): Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-104411](https://cve.now/CVE-2026-104411.md): Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads (CVSS 8.5, TryGhost Ghost · ghost)
- [CVE-2026-104410](https://cve.now/CVE-2026-104410.md): SiYuan before 3.8.5 Information Disclosure via /api/export/preview (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-103763](https://cve.now/CVE-2026-103763.md): SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-103762](https://cve.now/CVE-2026-103762.md): SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-85088](https://cve.now/CVE-2026-85088.md): Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match (CVSS 6.9, Apache Software Foundation Apache Thrift)
- [CVE-2026-85087](https://cve.now/CVE-2026-85087.md): Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op (CVSS 6.9, Apache Software Foundation Apache Thrift)
- [CVE-2026-85086](https://cve.now/CVE-2026-85086.md): Apache Thrift: Perl TLS client disables certificate verification by default (CVSS 6.9, Apache Software Foundation Apache Thrift)
- [CVE-2026-82459](https://cve.now/CVE-2026-82459.md): Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-82458](https://cve.now/CVE-2026-82458.md): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-96288](https://cve.now/CVE-2026-96288.md): Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-96292](https://cve.now/CVE-2026-96292.md): Apache Thrift: Lua \`THttpTransport:\_parseHeaders\` matches each header line with a backtracking pattern (quadratic) (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-96294](https://cve.now/CVE-2026-96294.md): Apache Thrift: nodejs web server: no \`error\` listener on an upgraded WebSocket connection (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-61373](https://cve.now/CVE-2026-61373.md): Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-96990](https://cve.now/CVE-2026-96990.md): Apache Thrift: Erlang thrift\_json\_protocol reads a whole message with no size bound (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94642](https://cve.now/CVE-2026-94642.md): Apache Thrift: PHP \`TSimpleServer\` exits the whole process on any non-transport exception (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-94644](https://cve.now/CVE-2026-94644.md): Apache Thrift: PHP \`TJSONProtocol\` string/number readers have no size bound (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94645](https://cve.now/CVE-2026-94645.md): Apache Thrift: Node.js \`TJSONProtocol\` uses a peer-declared container size as an unbounded loop bound (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94650](https://cve.now/CVE-2026-94650.md): Apache Thrift: c\_glib generated struct readers have no recursion-depth guard (native stack exhaustion) (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94651](https://cve.now/CVE-2026-94651.md): Apache Thrift: Java \`TSaslNonblockingServer\` \`Computation.run\` orphans a connection on a pre-auth parse error (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-85483](https://cve.now/CVE-2026-85483.md): Apache Thrift: c\_glib TZlibTransport reports a full read after a premature stream end (CVSS 6.3, Apache Software Foundation Apache Thrift)
- [CVE-2026-85493](https://cve.now/CVE-2026-85493.md): Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-85494](https://cve.now/CVE-2026-85494.md): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language) (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-97876](https://cve.now/CVE-2026-97876.md): Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address (CVSS 6.4, GNU grub2)
- [CVE-2026-104606](https://cve.now/CVE-2026-104606.md): itsourcecode Online Admission System Project confirm.php sql injection (CVSS 5.3, itsourcecode Online Admission System Project)
- [CVE-2026-91135](https://cve.now/CVE-2026-91135.md): Apache Thrift: C++ \`THeaderTransport::transform()\` heap buffer overflow (write direction) (CVSS 9.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-86326](https://cve.now/CVE-2026-86326.md): An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify th (CVSS 8.6, Moxa MGate MB3170 Series · Moxa MGate MB3270 Series)
- [CVE-2026-91137](https://cve.now/CVE-2026-91137.md): Apache Thrift: PHP \`thrift\_protocol\` accelerator: zero-byte container elements (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-86325](https://cve.now/CVE-2026-86325.md): A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. (CVSS 9.4, Moxa MGate MB3170 Series · Moxa MGate MB3270 Series)
- [CVE-2026-59668](https://cve.now/CVE-2026-59668.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-93925](https://cve.now/CVE-2026-93925.md): Apache Thrift: C++ \`THeaderTransport::writeVarint32()\` stack buffer overflow on a negative protocol id (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-59667](https://cve.now/CVE-2026-59667.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-93926](https://cve.now/CVE-2026-93926.md): Apache Thrift: C++ \`THeaderTransport::untransform()\` leaks the zlib stream on the error path (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-94633](https://cve.now/CVE-2026-94633.md): Apache Thrift: Dart \`TBinaryProtocol.readMessageBegin\` allocates from the pre-versioned name length (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-59666](https://cve.now/CVE-2026-59666.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-94634](https://cve.now/CVE-2026-94634.md): Apache Thrift: Python \`TJSONProtocol\` has a string length limit that is off by default (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-59665](https://cve.now/CVE-2026-59665.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-103885](https://cve.now/CVE-2026-103885.md): Apache Directory LDAP API: Denial of service via crafted telephone number values (CVSS 7.5, Apache Software Foundation Apache Directory LDAP API)
- [CVE-2026-103877](https://cve.now/CVE-2026-103877.md): Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements (CVSS 9.8, Apache Software Foundation Apache Directory LDAP API)
- [CVE-2026-59662](https://cve.now/CVE-2026-59662.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-103880](https://cve.now/CVE-2026-103880.md): Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords (CVSS 7.5, Apache Software Foundation Apache Directory LDAP API)
- [CVE-2026-59664](https://cve.now/CVE-2026-59664.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-103878](https://cve.now/CVE-2026-103878.md): Apache Directory LDAP API: Injection of plaintext responses during StartTLS (CVSS 7.5, Apache Software Foundation Apache Directory LDAP API)
- [CVE-2026-59663](https://cve.now/CVE-2026-59663.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-104403](https://cve.now/CVE-2026-104403.md): WordPress LearnPress plugin \<= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, ThimPress LearnPress)
- [CVE-2026-95662](https://cve.now/CVE-2026-95662.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-103552](https://cve.now/CVE-2026-103552.md): Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder (CVSS 7.3, Apache Software Foundation Apache Directory LDAP API)
- [CVE-2026-59661](https://cve.now/CVE-2026-59661.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-59660](https://cve.now/CVE-2026-59660.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-59659](https://cve.now/CVE-2026-59659.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-94180](https://cve.now/CVE-2026-94180.md): WordPress Advanced Ads plugin \<= 2.0.26 - Sensitive Data Exposure vulnerability (CVSS 4.3, Monetizemore Advanced Ads)
- [CVE-2026-94639](https://cve.now/CVE-2026-94639.md): Apache Thrift: Java \`TSaslNonblockingServer\`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) (CVSS 8.2, Apache Software Foundation Apache Thrift)
- [CVE-2026-94405](https://cve.now/CVE-2026-94405.md): WordPress Download Manager plugin \<= 3.3.71 - Sensitive Data Exposure vulnerability (CVSS 5.3, Shahjada Download Manager)
- [CVE-2026-97652](https://cve.now/CVE-2026-97652.md): WP Statistics \<= 14.16.14 - Reflected Cross-Site Scripting via REQUEST\_URI Query-Parameter Key (CVSS 6.1, veronalabs WP Statistics – Simple, privacy-friendly Google…)
- [CVE-2026-85492](https://cve.now/CVE-2026-85492.md): All in One SEO \<= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname (CVSS 6.1, smub All in One SEO – AI SEO Plugin to Boost SEO Rankings &…)
- [CVE-2026-87920](https://cve.now/CVE-2026-87920.md): W3 Total Cache \<= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, boldgrid W3 Total Cache)
- [CVE-2026-94541](https://cve.now/CVE-2026-94541.md): WPMobile.App \<= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp\_category\[\]' Parameter (CVSS 9.8, amauric WPMobile.App – Android and iOS App Builder)
- [CVE-2026-102731](https://cve.now/CVE-2026-102731.md): Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode (CVSS 7.5, Apache Software Foundation Apache Directory LDAP API)
- [CVE-2026-59673](https://cve.now/CVE-2026-59673.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-59672](https://cve.now/CVE-2026-59672.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-94635](https://cve.now/CVE-2026-94635.md): Apache Thrift: Lua \`TBinaryProtocol:readMessageBegin\` bypasses \`checkStringSize\` on the pre-versioned name (CVSS 8.7, Apache Software Foundation Apache Thrift)
- [CVE-2026-80298](https://cve.now/CVE-2026-80298.md): SQL Injection in HAVELSAN's Sef - AI Chatbot Platform (CVSS 8.8, HAVELSAN Sef - AI Chatbot Platform)
- [CVE-2026-59671](https://cve.now/CVE-2026-59671.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-95512](https://cve.now/CVE-2026-95512.md): Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader (CVSS 5.5, Red Hat Hardened Images · Red Hat build of OpenJDK 11 ELS +1)
- [CVE-2026-80443](https://cve.now/CVE-2026-80443.md): Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform (CVSS 7.4, HAVELSAN Sef - AI Chatbot Platform)
- [CVE-2026-59670](https://cve.now/CVE-2026-59670.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-80337](https://cve.now/CVE-2026-80337.md): Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform (CVSS 5.3, HAVELSAN Sef - AI Chatbot Platform)
- [CVE-2026-80464](https://cve.now/CVE-2026-80464.md): API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform (CVSS 4.9, HAVELSAN Sef - AI Chatbot Platform)
- [CVE-2026-59669](https://cve.now/CVE-2026-59669.md): Multiple vulnerabilities in the Repasat application (CVSS 4.8, Repasat application)
- [CVE-2026-91784](https://cve.now/CVE-2026-91784.md): Argument Injection leading to arbitrary process termination in gotop (CVSS 4.8, cjbassi gotop)
- [CVE-2026-18036](https://cve.now/CVE-2026-18036.md): NTRU leaks private key information by reducing secret values with a non-constant-time integer division (CVSS 8.2, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-97637](https://cve.now/CVE-2026-97637.md): JSON API Auth \<= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate\_auth\_cookie' Response (CVSS 9.8, parorrey JSON API Auth)
- [CVE-2026-94432](https://cve.now/CVE-2026-94432.md): Appointment Booking Plugin \<= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice\_id' Parameter (CVSS 5.3, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-97338](https://cve.now/CVE-2026-97338.md): Download Manager \<= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (CVSS 6.4, codename065 Download Manager)
- [CVE-2026-97634](https://cve.now/CVE-2026-97634.md): Event Tickets and Registration \<= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter (CVSS 6.5, stellarwp Event Tickets and Registration)
- [CVE-2026-96647](https://cve.now/CVE-2026-96647.md): Listdom: AI-powered Business Directory with Classifieds Ads Listings \<= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd\[remark\]' Parameter (CVSS 6.4, webilia Listdom: AI-powered Business Directory with Classif…)
- [CVE-2026-95670](https://cve.now/CVE-2026-95670.md): No External Links \<= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect (CVSS 7.2, mihdan No External Links)
- [CVE-2026-93756](https://cve.now/CVE-2026-93756.md): Smash Balloon Social Post Feed \<= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview (CVSS 7.2, smub Smash Balloon Social Post Feed – Simple Social Feeds f…)
- [CVE-2026-100107](https://cve.now/CVE-2026-100107.md): Kubio AI Page Builder \<= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass) (CVSS 7.2, extendthemes Kubio AI Page Builder)
- [CVE-2026-96871](https://cve.now/CVE-2026-96871.md): Mang Board \<= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data\_type' Parameter (CVSS 7.2, kitae-park Mang Board)
- [CVE-2026-97342](https://cve.now/CVE-2026-97342.md): JetFormBuilder \<= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action (CVSS 7.2, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-103426](https://cve.now/CVE-2026-103426.md): Relevanssi Premium \<= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '\_rt' Parameter (CVSS 7.2, Relevanssi Premium)
- [CVE-2026-96566](https://cve.now/CVE-2026-96566.md): Newsletter \<= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter (CVSS 7.2, satollo Newsletter – Send awesome emails from WordPress)
- [CVE-2026-102002](https://cve.now/CVE-2026-102002.md): Otter Blocks \<= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget (CVSS 3.1, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2026-12951](https://cve.now/CVE-2026-12951.md): MultiVendorX \<= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order\_by' Parameter (CVSS 6.5, wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI…)
- [CVE-2026-100182](https://cve.now/CVE-2026-100182.md): Download Monitor \<= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor (CVSS 7.2, wpchill Download Monitor)
- [CVE-2026-97641](https://cve.now/CVE-2026-97641.md): Relevanssi \<= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, comesio Relevanssi – A Better Search)
- [CVE-2026-102772](https://cve.now/CVE-2026-102772.md): CMB2 \<= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea\_code' Field (CVSS 7.2, jtsternberg CMB2)
- [CVE-2026-95817](https://cve.now/CVE-2026-95817.md): DoFollow Case by Case \<= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, apasionados DoFollow Case by Case)
- [CVE-2026-97336](https://cve.now/CVE-2026-97336.md): CMB2 \<= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file\_list' Field Type (CVSS 7.2, jtsternberg CMB2)
- [CVE-2026-93880](https://cve.now/CVE-2026-93880.md): Greenshift \<= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder (CVSS 6.1, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-96567](https://cve.now/CVE-2026-96567.md): MW WP Form \<= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post\_id' Parameter (via stored form-submitted post meta) (CVSS 7.2, websoudan MW WP Form)
- [CVE-2026-96578](https://cve.now/CVE-2026-96578.md): GSpeech TTS \<= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, creative-solutions-1 GSpeech TTS – WordPress Text To Speech…)
- [CVE-2026-97663](https://cve.now/CVE-2026-97663.md): Customer Reviews for WooCommerce \<= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 7.2, ivole Customer Reviews for WooCommerce)
- [CVE-2026-17508](https://cve.now/CVE-2026-17508.md): Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points (CVSS 5.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-17507](https://cve.now/CVE-2026-17507.md): MLS membership checks compare a uint32 leaf\_index as signed, admitting an out-of-range sender (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-103604](https://cve.now/CVE-2026-103604.md): Quadratic-time escaping when converting X.509 distinguished names to strings (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-103603](https://cve.now/CVE-2026-103603.md): Unbounded HSS public key level count allows huge array allocation during signature verification (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-103602](https://cve.now/CVE-2026-103602.md): Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-103601](https://cve.now/CVE-2026-103601.md): CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-103600](https://cve.now/CVE-2026-103600.md): Unbounded ASN.1 nesting depth causes process-terminating stack overflow (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63578](https://cve.now/CVE-2026-63578.md): Unbounded PBE iteration count when decrypting PKCS#8 private keys (CVSS 7.1, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63577](https://cve.now/CVE-2026-63577.md): Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63576](https://cve.now/CVE-2026-63576.md): URI name constraints checked against a mis-parsed host (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63575](https://cve.now/CVE-2026-63575.md): PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count (CVSS 7.1, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63574](https://cve.now/CVE-2026-63574.md): Unbounded allocation from OpenPGP signature and user attribute subpacket lengths (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63573](https://cve.now/CVE-2026-63573.md): Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63572](https://cve.now/CVE-2026-63572.md): Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files (CVSS 7.1, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63571](https://cve.now/CVE-2026-63571.md): Attribute certificate path validation does not verify the attribute certificate's signature (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63570](https://cve.now/CVE-2026-63570.md): Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links (CVSS 7.1, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63569](https://cve.now/CVE-2026-63569.md): MTI/A0 DHAgreement does not validate the peer's ephemeral value (CVSS 9.1, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63568](https://cve.now/CVE-2026-63568.md): Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63567](https://cve.now/CVE-2026-63567.md): IesEngine block-cipher mode checks padding before MAC (CBC padding oracle) (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-63566](https://cve.now/CVE-2026-63566.md): DTLS handshake reassembler allocates buffer from unchecked 24-bit length (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-97219](https://cve.now/CVE-2026-97219.md): MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter (CVSS 4.3, MStore API)
- [CVE-2026-92924](https://cve.now/CVE-2026-92924.md): Unlimited Elements For Elementor \< 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get\_addon\_output\_data (CVSS 5.4, Unlimited Elements for Elementor)
- [CVE-2026-91020](https://cve.now/CVE-2026-91020.md): WebToffee Gift Cards for WooCommerce \< 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt\_credit\_amount (CVSS 5.3, WebToffee Gift Cards for WooCommerce)
- [CVE-2026-90987](https://cve.now/CVE-2026-90987.md): Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price (CVSS 5.3, Easy PayPal & Stripe Buy Now Button)
- [CVE-2026-90952](https://cve.now/CVE-2026-90952.md): WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API (CVSS 5.3, WP Edit Password Protected)
- [CVE-2026-85005](https://cve.now/CVE-2026-85005.md): Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization (CVSS 5.4, Popup Maker WP)
- [CVE-2026-84740](https://cve.now/CVE-2026-84740.md): The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view\_data' Parameter (CVSS 6.5, The Events Calendar)
- [CVE-2026-79618](https://cve.now/CVE-2026-79618.md): WP User Frontend \< 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form (CVSS 4.3, WP User Frontend)
- [CVE-2026-1661](https://cve.now/CVE-2026-1661.md): WP Mail Logging \< 1.17.0 - Unauthenticated HTML Injection (CVSS 4.3, WP Mail Logging)
- [CVE-2026-13413](https://cve.now/CVE-2026-13413.md): CMP - Coming Soon & Maintenance \< 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match (CVSS 5.3, CMP – Coming Soon & Maintenance)
- [CVE-2026-16001](https://cve.now/CVE-2026-16001.md): IesEngine stream-mode MAC forgery via length-dependent KDF split (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-16000](https://cve.now/CVE-2026-16000.md): KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used (CVSS 8.7, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-15999](https://cve.now/CVE-2026-15999.md): AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication (CVSS 8.2, Legion of the Bouncy Castle bc-csharp)
- [CVE-2026-102565](https://cve.now/CVE-2026-102565.md): BA Book Everything \<= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking\_service\_qty' Parameter (CVSS 7.2, bookingalgorithms BA Book Everything)
- [CVE-2026-93029](https://cve.now/CVE-2026-93029.md): There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. (CVSS 9.0, Webpros cPanel · Webpros WP Squared)
- [CVE-2026-93697](https://cve.now/CVE-2026-93697.md): There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. (CVSS 9.0, Webpros cPanel · Webpros WP Squared)
- [CVE-2026-93698](https://cve.now/CVE-2026-93698.md): Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. (CVSS 9.9, Webpros cPanel · Webpros WP Squared)
- [CVE-2026-97318](https://cve.now/CVE-2026-97318.md): Giveaways and Contests by RafflePress \< 1.12.27 - Unauthenticated Stored Open Redirect via 'parent\_url' Parameter (CVSS 6.1, Giveaways and Contests by RafflePress)
- [CVE-2026-97317](https://cve.now/CVE-2026-97317.md): Giveaways and Contests by RafflePress \< 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page (CVSS 5.3, Giveaways and Contests by RafflePress)
- [CVE-2026-94298](https://cve.now/CVE-2026-94298.md): BuildKit \< 1.0.29 - Contributor+ Stored SQLi via list\_content Parameter (CVSS 6.2, BuildKit)
- [CVE-2026-91023](https://cve.now/CVE-2026-91023.md): Motors – Car Dealership & Classified Listings \< 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm\_make\_featured (CVSS 3.1, Motors)
- [CVE-2026-91022](https://cve.now/CVE-2026-91022.md): Motors \< 1.4.124 - Listing Manager+ Stored XSS via Badge Color (CVSS 6.8, Motors)
- [CVE-2026-85016](https://cve.now/CVE-2026-85016.md): Unlimited Elements For Elementor \< 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter (CVSS 6.8, Unlimited Elements for Elementor)
- [CVE-2026-91828](https://cve.now/CVE-2026-91828.md): OMGF \< 6.3.11 - Unauthenticated DoS via do\_optimize (CVSS 7.5, OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.)
- [CVE-2026-13718](https://cve.now/CVE-2026-13718.md): Tabs Responsive \<= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content (CVSS 6.8, Tabs Responsive)
- [CVE-2026-90988](https://cve.now/CVE-2026-90988.md): Request a Quote \<= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd\_get\_std\_pagenum (CVSS 5.3, Request a Quote)
- [CVE-2026-85004](https://cve.now/CVE-2026-85004.md): Popup Maker WP \<= 1.4.5 - Subscriber+ Missing Authorization via sgpm\_connect (CVSS 4.3, Popup Maker)
- [CVE-2026-81740](https://cve.now/CVE-2026-81740.md): Paytm Payment Gateway \< 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback (CVSS 5.3, Paytm Payment Gateway)
- [CVE-2026-15896](https://cve.now/CVE-2026-15896.md): Super Forms \<= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter (CVSS 9.1, WebRehab Super Forms – Drag & Drop Form Builder)
- [CVE-2026-78471](https://cve.now/CVE-2026-78471.md): Autoptimize \<= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 5.4, optimizingmatters Autoptimize)
- [CVE-2026-92174](https://cve.now/CVE-2026-92174.md): SiteOrigin Widgets Bundle \<= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter (CVSS 7.5, gpriday SiteOrigin Widgets Bundle)
- [CVE-2026-90438](https://cve.now/CVE-2026-90438.md): Ninja Forms \<= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission (CVSS 7.2, kstover Ninja Forms – Contact Form Builder with Calculators…)
- [CVE-2026-15897](https://cve.now/CVE-2026-15897.md): Super Forms – Drag & Drop Form Builder \<= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user\_id' Parameter in Register & Login (CVSS 8.8, WebRehab Super Forms – Drag & Drop Form Builder)
- [CVE-2026-92820](https://cve.now/CVE-2026-92820.md): Ninja Forms - File Uploads \<= 3.3.34 - Unauthenticated Arbitrary File Upload (CVSS 8.1, SaturdayDrive Ninja Forms - File Uploads)
- [CVE-2026-84925](https://cve.now/CVE-2026-84925.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter (CVSS 6.1, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2026-10026](https://cve.now/CVE-2026-10026.md): CTX Feed Pro \<= 7.6.12 - Authenticated (Administrator+) Remote Code Execution (CVSS 7.2, CTX Feed Pro)
- [CVE-2026-19660](https://cve.now/CVE-2026-19660.md): Divi Membership \<= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal\_param' Parameter (CVSS 9.8, DiviEngine Divi Membership)
- [CVE-2026-93367](https://cve.now/CVE-2026-93367.md): Visitors Traffic Real Time Statistics Pro \<= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro\_track\_visitor (page\_title) (CVSS 7.2, wp-buy Visitor Traffic Real Time Statistics pro)
- [CVE-2026-14378](https://cve.now/CVE-2026-14378.md): DevKit Pro \<= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original\_user\_id' Cookie in Frontend Revert Switch Flow (CVSS 9.8, dplugins DevKit Pro)
- [CVE-2026-104123](https://cve.now/CVE-2026-104123.md): SourceCodester Online Reviewer Management System btn\_functions.php activity sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-104120](https://cve.now/CVE-2026-104120.md): modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch\_url server-side request forgery (CVSS 6.9, modelcontextprotocol mcp-server-fetch · modelcontextprotoco…)
- [CVE-2026-104054](https://cve.now/CVE-2026-104054.md): calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization (CVSS 5.3, calcom cal.diy)
- [CVE-2026-104053](https://cve.now/CVE-2026-104053.md): itsourcecode Pet Shop Management System admin\_reservefilter.php sql injection (CVSS 5.3, itsourcecode Pet Shop Management System)
- [CVE-2026-21140](https://cve.now/CVE-2026-21140.md): Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications. (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-104052](https://cve.now/CVE-2026-104052.md): itsourcecode Pet Shop Management System admin\_reject\_completed.php sql injection (CVSS 5.3, itsourcecode Pet Shop Management System)
- [CVE-2026-104480](https://cve.now/CVE-2026-104480.md): Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership (CVSS 9.4, Discord libdave)
- [CVE-2026-103098](https://cve.now/CVE-2026-103098.md): GV-Eye Sensitive information exposure in URL query parameter Vulnerability (CVSS 7.5, GeoVision GV-Eye)
- [CVE-2026-103097](https://cve.now/CVE-2026-103097.md): GV-Eye Relay Payment API Key Vulnerability (CVSS 7.5, GeoVision GV-Eye)
- [CVE-2026-103096](https://cve.now/CVE-2026-103096.md): GV-Eye Hardcoded API Key Vulnerability (CVSS 7.5, GeoVision GV-Eye)
- [CVE-2026-51898](https://cve.now/CVE-2026-51898.md): sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute. (CVSS 9.8)
- [CVE-2026-51899](https://cve.now/CVE-2026-51899.md): In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit\_schedule (CVSS 4.3)
- [CVE-2026-51901](https://cve.now/CVE-2026-51901.md): SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. (CVSS 8.1)
- [CVE-2026-51904](https://cve.now/CVE-2026-51904.md): SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. (CVSS 9.8)
- [CVE-2026-51906](https://cve.now/CVE-2026-51906.md): In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save\_url\_image function, a path traversal vulnerability allows attackers to write (CVSS 9.1)
- [CVE-2026-51907](https://cve.now/CVE-2026-51907.md): In TaskingAI v0.3.0 in the QR Code Generator plugin save\_base64\_image function, a path traversal vulnerability allows attackers to write ima (CVSS 8.1)
- [CVE-2026-51911](https://cve.now/CVE-2026-51911.md): vanna v2.0.2 contains a code injection vulnerability in VannaBase.get\_plotly\_figure (src/vanna/legacy/base/base.py). (CVSS 9.8)
- [CVE-2026-51914](https://cve.now/CVE-2026-51914.md): TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. (CVSS 8.8)
- [CVE-2026-51915](https://cve.now/CVE-2026-51915.md): TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. (CVSS 9.8)
- [CVE-2026-51916](https://cve.now/CVE-2026-51916.md): TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete\_user\_knowledge in superagi/controllers/know (CVSS 7.5)
- [CVE-2026-51917](https://cve.now/CVE-2026-51917.md): FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify\_code. (CVSS 7.3)
- [CVE-2026-51918](https://cve.now/CVE-2026-51918.md): FinRobot 1.0.0 contains code injection in CodingUtils.create\_file\_with\_code (). (CVSS 9.8)
- [CVE-2026-51922](https://cve.now/CVE-2026-51922.md): agentscope v1.0.20 contains code injection in execute\_shell\_command (src/agentscope/tool/\_coding/\_shell.py). (CVSS 9.8)
- [CVE-2026-67989](https://cve.now/CVE-2026-67989.md): crmne/ruby\_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.