# CVEs published 2026-10-05

413 CVEs were published on October 5, 2026: 33 critical, 122 high. 1 is now in CISA KEV. Days are UTC.

- [GHSA-2MJX-QC3C-RQVC](https://cve.now/GHSA-2MJX-QC3C-RQVC.md): Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries (medium (no CVSS), rustls)
- [CVE-2026-105786](https://cve.now/CVE-2026-105786.md): Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier (CVSS 8.5, laurent22 joplin)
- [CVE-2026-105471](https://cve.now/CVE-2026-105471.md): girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection (CVSS 6.9, girishsaraf Online-Appointment-Booking-System)
- [CVE-2026-82988](https://cve.now/CVE-2026-82988.md): CVE-2026-82988 (CVSS 7.5, Viewsonic vCast)
- [CVE-2026-82989](https://cve.now/CVE-2026-82989.md): CVE-2026-82989 (CVSS 9.8, Viewsonic vCast)
- [CVE-2026-105785](https://cve.now/CVE-2026-105785.md): Joplin Server password reset accepts tokens issued for unrelated purposes (CVSS 4.8, laurent22 joplin)
- [CVE-2026-105784](https://cve.now/CVE-2026-105784.md): Joplin whiteboard card rendering allows CSS injection into application chrome (CVSS 4.6, laurent22 joplin)
- [CVE-2026-105783](https://cve.now/CVE-2026-105783.md): Joplin Web Clipper pairing allows cross-origin theft of a permanent API token (CVSS 8.0, laurent22 joplin)
- [CVE-2026-105782](https://cve.now/CVE-2026-105782.md): Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware (CVSS 7.5, scrapy)
- [CVE-2026-105764](https://cve.now/CVE-2026-105764.md): Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE (CVSS 7.7, immich-app immich)
- [CVE-2026-105763](https://cve.now/CVE-2026-105763.md): Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL (CVSS 9.6, twentyhq twenty)
- [CVE-2026-105762](https://cve.now/CVE-2026-105762.md): Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint (CVSS 8.3, langgenius dify)
- [CVE-2026-105761](https://cve.now/CVE-2026-105761.md): Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers (CVSS 7.1, langgenius dify)
- [CVE-2026-105760](https://cve.now/CVE-2026-105760.md): vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion (CVSS 5.3, vllm-project vllm · vllm)
- [CVE-2026-105759](https://cve.now/CVE-2026-105759.md): vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service) (CVSS 5.9, vllm-project vllm · vllm)
- [CVE-2026-104852](https://cve.now/CVE-2026-104852.md): GraphQL Tools has prototype pollution in well-established utility function \`mergeDeep\` (CVSS 8.2, ardatan graphql-tools · @graphql-tools/utils)
- [CVE-2026-105758](https://cve.now/CVE-2026-105758.md): vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max\_frames, which the num\_frames ceiling does not reach (CVSS 5.3, vllm-project vllm · vllm)
- [CVE-2026-105757](https://cve.now/CVE-2026-105757.md): vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites) (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-105756](https://cve.now/CVE-2026-105756.md): vLLM: Loose \`cache\_salt\` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream \`ValueError\` denial of service (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-105755](https://cve.now/CVE-2026-105755.md): vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on \`/score\` and \`/rerank\` (CVSS 4.2, vllm-project vllm · vllm)
- [CVE-2026-105754](https://cve.now/CVE-2026-105754.md): vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-105753](https://cve.now/CVE-2026-105753.md): vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-105752](https://cve.now/CVE-2026-105752.md): vLLM: Harmony tool continuations drop \`cache\_salt\` — restoring a cross-tenant prefix-cache membership oracle (CVSS 3.1, vllm-project vllm · vllm)
- [CVE-2026-105470](https://cve.now/CVE-2026-105470.md): girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli\_query sql injection (CVSS 6.9, girishsaraf Online-Appointment-Booking-System)
- [CVE-2026-105469](https://cve.now/CVE-2026-105469.md): girishsaraf Online-Appointment-Booking-System AJAX Endpoint get\_town.php sql injection (CVSS 6.9, girishsaraf Online-Appointment-Booking-System)
- [CVE-2026-93321](https://cve.now/CVE-2026-93321.md): Malformed LLB file operation can crash buildkitd (CVSS 6.9, moby BuildKit)
- [CVE-2026-93315](https://cve.now/CVE-2026-93315.md): BuildKit proxy CA cleanup can be disrupted by build steps (CVSS 5.8, moby BuildKit)
- [CVE-2026-103433](https://cve.now/CVE-2026-103433.md): Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions (CVSS 6.9, Docker Buildx)
- [CVE-2026-103546](https://cve.now/CVE-2026-103546.md): Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator (CVSS 2.3, Mongodb Controllers for Kubernetes)
- [CVE-2026-105468](https://cve.now/CVE-2026-105468.md): girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli\_query sql injection (CVSS 6.9, girishsaraf Online-Appointment-Booking-System)
- [CVE-2026-105751](https://cve.now/CVE-2026-105751.md): Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 6.9, docling-project docling · docling)
- [CVE-2026-105750](https://cve.now/CVE-2026-105750.md): Docling: \`enable\_local\_fetch\` is not enforced in HTML browser-rendering mode (CVSS 5.9, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-0461](https://cve.now/CVE-2026-0461.md): Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded (CVSS 7.5, AMD Zynq™ UltraScale+ MPSoCs · AMD Zynq™ UltraScale+ RFS… +1)
- [CVE-2026-105749](https://cve.now/CVE-2026-105749.md): Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion (CVSS 6.5, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-0482](https://cve.now/CVE-2026-0482.md): In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow craf (CVSS 5.4, AMD Alveo™ Accelerator Cards · AMD Versal™ Prime Series… +6)
- [CVE-2026-105748](https://cve.now/CVE-2026-105748.md): Docling: Crafted DoclingDocument JSON embeds local image files into converted output (CVSS 4.3, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-105747](https://cve.now/CVE-2026-105747.md): Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) (CVSS 4.3, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-105746](https://cve.now/CVE-2026-105746.md): Docling: KServe v2 OCR engine does not enforce enable\_remote\_services (CVSS 2.2, docling-project docling · docling-project docling-slim +1)
- [CVE-2026-21589](https://cve.now/CVE-2026-21589.md): This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Ba (CVSS 9.3, KEV, Atlassian Bamboo Data Center · Atlassian Bitbucket Data… +6)
- [CVE-2026-91107](https://cve.now/CVE-2026-91107.md): openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR) (CVSS 9.3, OS4ED openSIS-Classic)
- [CVE-2026-105745](https://cve.now/CVE-2026-105745.md): Docling: Plugin entry points are imported before the allow\_external\_plugins check (CVSS 6.7, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-105744](https://cve.now/CVE-2026-105744.md): Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 7.5, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-105743](https://cve.now/CVE-2026-105743.md): Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) (CVSS 4.0, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-105742](https://cve.now/CVE-2026-105742.md): Docling: Configured HTTP headers sent to every remote image host named by a document (CVSS 3.7, docling-project docling · docling-project docling-slim +2)
- [CVE-2026-105444](https://cve.now/CVE-2026-105444.md): dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection (CVSS 5.3, dotnet eShop)
- [CVE-2026-105741](https://cve.now/CVE-2026-105741.md): Langflow: IP Spoofing Bypass via \`X-Forwarded-For\` Allowing Remote Configuration Write (CVSS 7.1, langflow-ai langflow · langflow)
- [CVE-2026-105740](https://cve.now/CVE-2026-105740.md): Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server (CVSS 9.9, langflow-ai langflow)
- [CVE-2026-105438](https://cve.now/CVE-2026-105438.md): O2OA General url ActionUploadExcelWithUrl server-side request forgery (CVSS 5.3, O2OA)
- [CVE-2026-105773](https://cve.now/CVE-2026-105773.md): Canimaan Software ClamXAV local privilege escalation (CVSS 7.3, Canimaan Software ClamXAV)
- [CVE-2026-105699](https://cve.now/CVE-2026-105699.md): Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers (CVSS 7.1, langflow-ai langflow · langflow)
- [CVE-2026-102262](https://cve.now/CVE-2026-102262.md): Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control (CVSS 7.0, Newell Brands DYMO ID)
- [CVE-2026-101893](https://cve.now/CVE-2026-101893.md): Newell Brands DYMO ID document parsing failing file type extension authentication check (CVSS 4.4, Newell Brands DYMO ID)
- [CVE-2026-105447](https://cve.now/CVE-2026-105447.md): Quay: quay: global read-only superuser can access build trigger write credentials (CVSS 5.5, Red Hat Quay)
- [CVE-2026-84900](https://cve.now/CVE-2026-84900.md): HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates (CVSS 6.8, HP ThinPro)
- [CVE-2026-77226](https://cve.now/CVE-2026-77226.md): Camunda 7.24.0 \< 7.24.15 Incorrect Authorization via SetupResource Endpoint (CVSS 9.2, Camunda)
- [CVE-2026-105698](https://cve.now/CVE-2026-105698.md): Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow\_id}/vertices endpoints (CVSS 5.4, langflow-ai langflow · langflow-ai langflow-base +2)
- [CVE-2026-105768](https://cve.now/CVE-2026-105768.md): apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root (CVSS 6.3, chainguard-dev apko)
- [CVE-2026-105697](https://cve.now/CVE-2026-105697.md): Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration (CVSS 9.9, langflow-ai langflow · langflow-ai langflow-base +4)
- [CVE-2026-93326](https://cve.now/CVE-2026-93326.md): Crafted Git build source can bypass certain policy validation (CVSS 6.0, moby BuildKit)
- [CVE-2026-105696](https://cve.now/CVE-2026-105696.md): Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command (CVSS 6.5, penpot)
- [CVE-2026-105695](https://cve.now/CVE-2026-105695.md): Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session (CVSS 5.9, penpot)
- [CVE-2026-105694](https://cve.now/CVE-2026-105694.md): Penpot: Stored XSS via Unsanitised SVG Uploads (CVSS 5.4, penpot)
- [CVE-2026-105693](https://cve.now/CVE-2026-105693.md): Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle (CVSS 5.3, penpot)
- [CVE-2026-71297](https://cve.now/CVE-2026-71297.md): Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional (CVSS 5.4, Red Hat Multicluster Engine for Kubernetes)
- [CVE-2026-105692](https://cve.now/CVE-2026-105692.md): Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create (CVSS 5.4, penpot)
- [CVE-2026-105691](https://cve.now/CVE-2026-105691.md): Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color (CVSS 9.9, penpot)
- [CVE-2026-105690](https://cve.now/CVE-2026-105690.md): Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access (CVSS 5.9, penpot)
- [CVE-2026-105689](https://cve.now/CVE-2026-105689.md): Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download (CVSS 6.0, penpot)
- [CVE-2026-105688](https://cve.now/CVE-2026-105688.md): Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path) (CVSS 6.7, penpot)
- [CVE-2026-105687](https://cve.now/CVE-2026-105687.md): Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection (CVSS 4.9, penpot)
- [CVE-2026-105767](https://cve.now/CVE-2026-105767.md): Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands (CVSS 2.1, Chainguard Academy)
- [CVE-2026-105686](https://cve.now/CVE-2026-105686.md): Penpot: Repeated chunk index causes temporary-storage amplification (CVSS 5.3, penpot)
- [CVE-2026-105766](https://cve.now/CVE-2026-105766.md): Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP (CVSS 2.3, Chainguard Academy)
- [CVE-2026-105392](https://cve.now/CVE-2026-105392.md): Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key (CVSS 6.9, Lybbn Django-Vue-Lyadmin)
- [CVE-2026-105684](https://cve.now/CVE-2026-105684.md): Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope (CVSS 4.3, penpot)
- [CVE-2026-105683](https://cve.now/CVE-2026-105683.md): Ghost: Path Traversal Vulnerability in Ghost ImageSize Service (CVSS 3.8, TryGhost Ghost · ghost)
- [CVE-2026-105389](https://cve.now/CVE-2026-105389.md): feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload (CVSS 5.3, feelec-yishu feelcrm-os)
- [CVE-2026-105682](https://cve.now/CVE-2026-105682.md): Ghost: Server-Side Request Forgery in Webhook Trigger (CVSS 2.7, TryGhost Ghost · ghost)
- [CVE-2026-105681](https://cve.now/CVE-2026-105681.md): Ghost: Authorization Bypass in Comments Feature (CVSS 6.5, TryGhost Ghost · ghost)
- [CVE-2026-105680](https://cve.now/CVE-2026-105680.md): Ghost: Authorization Issue Allowed Author Role to Delete any Post (CVSS 6.5, TryGhost Ghost · ghost)
- [CVE-2026-105679](https://cve.now/CVE-2026-105679.md): Ghost: Stored XSS via File Uploads on Local Storage (CVSS 7.3, TryGhost Ghost · ghost)
- [CVE-2026-105678](https://cve.now/CVE-2026-105678.md): Ghost: Editors Could Promote Staff Users to Their Own Role (CVSS 4.3, TryGhost Ghost · ghost)
- [CVE-2026-94201](https://cve.now/CVE-2026-94201.md): Filtering an :atom attribute with unsafe\_to\_atom? can exhaust the BEAM atom table in Ash (CVSS 8.2, ash-project ash · ash)
- [CVE-2026-105677](https://cve.now/CVE-2026-105677.md): Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2, TryGhost Ghost · ghost)
- [CVE-2026-105676](https://cve.now/CVE-2026-105676.md): Ghost: Path Traversal via Locale Setting (CVSS 4.9, TryGhost Ghost · ghost)
- [CVE-2026-105388](https://cve.now/CVE-2026-105388.md): feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection (CVSS 5.3, feelec-yishu feelcrm-os)
- [CVE-2026-104029](https://cve.now/CVE-2026-104029.md): Sssd: sssd: denial of service via out-of-bounds read in autofs responder (CVSS 3.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-105675](https://cve.now/CVE-2026-105675.md): Ghost: Invite Token Disclosure in Ghost Admin API (CVSS 7.5, TryGhost Ghost · ghost)
- [CVE-2026-105652](https://cve.now/CVE-2026-105652.md): Ghost: Password Hash Ordering Disclosure in Ghost Admin API (CVSS 3.1, TryGhost Ghost · ghost)
- [CVE-2026-105651](https://cve.now/CVE-2026-105651.md): Ghost: Stored XSS via Bookmark Card Images (CVSS 7.3, TryGhost Ghost · ghost)
- [CVE-2026-105650](https://cve.now/CVE-2026-105650.md): Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1, TryGhost Ghost · ghost)
- [CVE-2026-104030](https://cve.now/CVE-2026-104030.md): Sssd: sssd: denial of service via out-of-bounds read during passkey parsing (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-71299](https://cve.now/CVE-2026-71299.md): Maestro: maestro: rest api write endpoints registered without authentication middleware (CVSS 6.5, Red Hat Multicluster Engine for Kubernetes)
- [CVE-2026-71298](https://cve.now/CVE-2026-71298.md): Maestro: sql identifier injection via properties.\* search filter and orderby field (CVSS 6.4, Red Hat Multicluster Engine for Kubernetes)
- [CVE-2026-105649](https://cve.now/CVE-2026-105649.md): Ghost: Stored XSS via SVG Uploads Bypassing Sanitization (CVSS 7.3, TryGhost Ghost · ghost)
- [CVE-2026-105648](https://cve.now/CVE-2026-105648.md): Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses (CVSS 4.0, TryGhost Ghost · ghost)
- [CVE-2026-105647](https://cve.now/CVE-2026-105647.md): Ghost: Server-Side Request Forgery in Bookmark Fetching (CVSS 4.0, TryGhost Ghost · ghost)
- [CVE-2026-103066](https://cve.now/CVE-2026-103066.md): WordPress WP BASE Booking plugin \<= 6.4.0 - SQL Injection vulnerability (CVSS 8.5, WP BASE Booking)
- [CVE-2026-100506](https://cve.now/CVE-2026-100506.md): WordPress WP Spell Check plugin \<= 12.1 - PHP Object Injection vulnerability (CVSS 7.2, WP Spell Check)
- [CVE-2026-100511](https://cve.now/CVE-2026-100511.md): WordPress VK Google Job Posting Manager plugin \<= 1.3.1 - PHP Object Injection vulnerability (CVSS 8.8, Vektor VK Google Job Posting Manager)
- [CVE-2026-97257](https://cve.now/CVE-2026-97257.md): WordPress Simple Event Planner plugin \<= 1.5.7 - PHP Object Injection vulnerability (CVSS 8.8, PressTigers Simple Event Planner)
- [CVE-2026-93617](https://cve.now/CVE-2026-93617.md): WordPress Sunshine Photo Cart plugin \<= 3.7.1 - PHP Object Injection vulnerability (CVSS 7.2, WP Sunshine Sunshine Photo Cart)
- [CVE-2026-103348](https://cve.now/CVE-2026-103348.md): WordPress WP Ultimate Exporter plugin \<= 3.0 - PHP Object Injection vulnerability (CVSS 7.2, Smackcoders WP Ultimate Exporter)
- [CVE-2026-103337](https://cve.now/CVE-2026-103337.md): WordPress WC Ukraine Shipping plugin \<= 1.23.2 - Broken Access Control vulnerability (CVSS 6.5, Kirillbdev WC Ukraine Shipping)
- [CVE-2026-105326](https://cve.now/CVE-2026-105326.md): Cups: cups: argument injection in mailto notifier via notify-recipient-uri (CVSS 2.5, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-105646](https://cve.now/CVE-2026-105646.md): Ghost: Regular Expression Denial of Service in Content Import (CVSS 4.9, TryGhost Ghost · ghost)
- [CVE-2026-105645](https://cve.now/CVE-2026-105645.md): Ghost: Regular Expression Denial of Service in External Media Inliner (CVSS 4.9, TryGhost Ghost · ghost)
- [CVE-2026-105712](https://cve.now/CVE-2026-105712.md): gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. (CVSS 3.6, GnuPG)
- [CVE-2026-105644](https://cve.now/CVE-2026-105644.md): Ghost: Stored XSS via SVG Files in Content Imports (CVSS 6.8, TryGhost Ghost · ghost)
- [CVE-2026-105643](https://cve.now/CVE-2026-105643.md): Ghost: Stored XSS via Embed Card Previews (CVSS 7.3, TryGhost Ghost · ghost)
- [CVE-2026-105387](https://cve.now/CVE-2026-105387.md): girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli\_query sql injection (CVSS 6.9, girishsaraf Online-Appointment-Booking-System)
- [CVE-2026-28648](https://cve.now/CVE-2026-28648.md): In Settings, there is a possible permission bypass due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2026-28647](https://cve.now/CVE-2026-28647.md): In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-28641](https://cve.now/CVE-2026-28641.md): In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic e (CVSS 7.8, Google Android)
- [CVE-2026-28640](https://cve.now/CVE-2026-28640.md): In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input (CVSS 7.8, Google Android)
- [CVE-2026-28625](https://cve.now/CVE-2026-28625.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-104714](https://cve.now/CVE-2026-104714.md): Apache Struts: Shared message formatter exposes date and time values across concurrent requests (CVSS 8.8, Apache Software Foundation Apache Struts)
- [CVE-2026-104713](https://cve.now/CVE-2026-104713.md): Apache Struts: Unbounded request body read in the REST plugin (CVSS 6.5, Apache Software Foundation Apache Struts)
- [CVE-2026-104712](https://cve.now/CVE-2026-104712.md): Apache Struts: Disproportionate response size when rendering BigDecimal request parameters (CVSS 7.5, Apache Software Foundation Apache Struts)
- [CVE-2026-104711](https://cve.now/CVE-2026-104711.md): Apache Struts: OGNL injection in the legacy RESTful action mapper (CVSS 9.8, Apache Software Foundation Apache Struts)
- [CVE-2026-105642](https://cve.now/CVE-2026-105642.md): Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8, TryGhost Ghost · ghost)
- [CVE-2026-105386](https://cve.now/CVE-2026-105386.md): onetwothreeneth HospitalManagementSystem print.php get sql injection (CVSS 6.9, onetwothreeneth HospitalManagementSystem)
- [CVE-2026-58880](https://cve.now/CVE-2026-58880.md): In handle\_app\_val\_response of btif\_rc.cc, there is a possible way to achieve code execution due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2026-58865](https://cve.now/CVE-2026-58865.md): In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2026-58859](https://cve.now/CVE-2026-58859.md): In multiple places, there is a possible denial of service due to an uncaught exception. (CVSS 7.8, Google Android)
- [CVE-2026-58856](https://cve.now/CVE-2026-58856.md): In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 3.3, Google Android)
- [CVE-2026-58854](https://cve.now/CVE-2026-58854.md): In multiple locations, there is a possible memory corruption due to type confusion. (CVSS 7.8, Google Android)
- [CVE-2026-58841](https://cve.now/CVE-2026-58841.md): In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-58835](https://cve.now/CVE-2026-58835.md): In cfg2prop of btif\_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 8.8, Google Android)
- [CVE-2026-58834](https://cve.now/CVE-2026-58834.md): In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input valida (CVSS 5.5, Google Android)
- [CVE-2026-58815](https://cve.now/CVE-2026-58815.md): In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-55286](https://cve.now/CVE-2026-55286.md): In stpropnci\_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-55280](https://cve.now/CVE-2026-55280.md): In multiple locations, there is a possible out-of-bounds write due to uninitialized data. (CVSS 8.8, Google Android)
- [CVE-2026-55270](https://cve.now/CVE-2026-55270.md): In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2026-55269](https://cve.now/CVE-2026-55269.md): In FilterCapturedPacket of snoop\_logger.cc, there is a possible memory safety issue due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2026-55266](https://cve.now/CVE-2026-55266.md): In qsort of libufdt\_sysdeps\_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. (CVSS 7.8, Google Android)
- [CVE-2026-55265](https://cve.now/CVE-2026-55265.md): In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2026-49937](https://cve.now/CVE-2026-49937.md): In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-49933](https://cve.now/CVE-2026-49933.md): In handle\_le\_monitor\_device\_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitia (CVSS 7.8, Google Android)
- [CVE-2026-49885](https://cve.now/CVE-2026-49885.md): In rw\_t4t\_update\_file of rw\_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. (CVSS 7.8, Google Android)
- [CVE-2026-49880](https://cve.now/CVE-2026-49880.md): In multiple functions of nfa\_nfcee\_act.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-49878](https://cve.now/CVE-2026-49878.md): In wpas\_handle\_robust\_av\_scs\_recv\_action of robust\_av.c, there is a possible out-of-bounds write due to a logic error in the code. (CVSS 7.2, Google Android)
- [CVE-2026-45524](https://cve.now/CVE-2026-45524.md): In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. (CVSS 8.8, Google Android)
- [CVE-2026-28667](https://cve.now/CVE-2026-28667.md): In multiple functions of rw\_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2026-105641](https://cve.now/CVE-2026-105641.md): Plane: Hardcoded SECRET\_KEY and LIVE\_SERVER\_SECRET\_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass (CVSS 9.8, makeplane plane)
- [CVE-2026-105640](https://cve.now/CVE-2026-105640.md): Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) (CVSS 9.1, makeplane plane)
- [CVE-2026-105639](https://cve.now/CVE-2026-105639.md): Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane (CVSS 9.8, makeplane plane)
- [CVE-2026-105638](https://cve.now/CVE-2026-105638.md): Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force (CVSS 9.1, makeplane plane)
- [CVE-2026-103349](https://cve.now/CVE-2026-103349.md): WordPress Product Feed PRO for WooCommerce plugin \<= 13.5.7 - PHP Object Injection vulnerability (CVSS 7.2, Rymera Web Product Feed PRO for WooCommerce)
- [CVE-2026-97303](https://cve.now/CVE-2026-97303.md): WordPress Scratch & Win – Giveaways and Contests plugin \<= 3.0.2 - Broken Access Control vulnerability (CVSS 7.6, Apps Mav Scratch & Win – Giveaways and Contests)
- [CVE-2026-103352](https://cve.now/CVE-2026-103352.md): WordPress WP BASE Booking plugin \<= 6.4.0 - SQL Injection vulnerability (CVSS 9.3, WP BASE Booking)
- [CVE-2026-97283](https://cve.now/CVE-2026-97283.md): WordPress Advanced Post Manager plugin \<= 4.5.5 - PHP Object Injection vulnerability (CVSS 9.8, Liquid Web / StellarWP Advanced Post Manager)
- [CVE-2026-97275](https://cve.now/CVE-2026-97275.md): WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin \<= 1.0.28 - Bypass Vulnerability vulnerability (CVSS 5.3, VillaTheme BuildKit – Product Builder for WooCommerce – Cus…)
- [CVE-2026-97309](https://cve.now/CVE-2026-97309.md): WordPress RepairBuddy plugin \<= 4.1226 - Sensitive Data Exposure vulnerability (CVSS 7.1, Webful Creations RepairBuddy)
- [CVE-2026-97070](https://cve.now/CVE-2026-97070.md): WordPress Cozy Blocks plugin \<= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.9, CozyThemes Cozy Blocks)
- [CVE-2026-97305](https://cve.now/CVE-2026-97305.md): WordPress AI Chatbot for WordPress – Hyve Lite plugin \<= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.9, Themeisle AI Chatbot for WordPress – Hyve Lite)
- [CVE-2026-103334](https://cve.now/CVE-2026-103334.md): WordPress Five Star Restaurant Reservations plugin \<= 2.7.24 - Sensitive Data Exposure vulnerability (CVSS 7.5, Etoile Web Design Incorporated Five Star Restaurant Reserva…)
- [CVE-2026-97304](https://cve.now/CVE-2026-97304.md): WordPress Timetics plugin \<= 1.0.63 - Broken Access Control vulnerability (CVSS 6.5, Arraytics Timetics)
- [CVE-2026-100515](https://cve.now/CVE-2026-100515.md): WordPress Photo Reviews for WooCommerce plugin \<= 1.2.30 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VillaTheme Photo Reviews for WooCommerce)
- [CVE-2026-103085](https://cve.now/CVE-2026-103085.md): WordPress WP User Manager plugin \<= 2.9.20 - Privilege Escalation vulnerability (CVSS 6.5, WP User Manager)
- [CVE-2026-103086](https://cve.now/CVE-2026-103086.md): WordPress UsersWP plugin \<= 1.2.74 - Broken Access Control vulnerability (CVSS 6.5, Stiofan UsersWP)
- [CVE-2026-100509](https://cve.now/CVE-2026-100509.md): WordPress RepairBuddy plugin \<= 4.1225 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Webful Creations RepairBuddy)
- [CVE-2026-102383](https://cve.now/CVE-2026-102383.md): WordPress Lookzy plugin \<= 1.1.14 - Broken Access Control vulnerability (CVSS 6.5, VillaTheme Lookzy)
- [CVE-2026-105637](https://cve.now/CVE-2026-105637.md): Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) (CVSS 9.6, makeplane plane)
- [CVE-2026-105636](https://cve.now/CVE-2026-105636.md): Plane: SSRF via HTTP redirect in webhook delivery (allow\_redirects not set) (CVSS 9.9, makeplane plane)
- [CVE-2026-105635](https://cve.now/CVE-2026-105635.md): Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token (CVSS 7.4, makeplane plane)
- [CVE-2026-105634](https://cve.now/CVE-2026-105634.md): Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles (CVSS 8.1, makeplane plane)
- [CVE-2026-105633](https://cve.now/CVE-2026-105633.md): Plane: Issue Attachment Ownership Hijacking via Missing \`issue\_id\` Scope (CVSS 7.1, makeplane plane)
- [CVE-2026-105632](https://cve.now/CVE-2026-105632.md): Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects (CVSS 8.7, makeplane plane)
- [CVE-2026-93323](https://cve.now/CVE-2026-93323.md): Oversized Dockerfile or .dockerignore can exhaust buildkitd memory (CVSS 6.8, moby BuildKit)
- [CVE-2026-105631](https://cve.now/CVE-2026-105631.md): Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure (CVSS 7.5, makeplane plane)
- [CVE-2026-105630](https://cve.now/CVE-2026-105630.md): Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) (CVSS 8.7, makeplane plane)
- [CVE-2026-93322](https://cve.now/CVE-2026-93322.md): Malformed MergeOp can crash the BuildKit daemon (CVSS 6.9, moby BuildKit)
- [CVE-2026-105629](https://cve.now/CVE-2026-105629.md): Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup (CVSS 7.1, makeplane plane)
- [CVE-2026-105628](https://cve.now/CVE-2026-105628.md): Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint (CVSS 7.6, makeplane plane)
- [CVE-2026-93320](https://cve.now/CVE-2026-93320.md): BuildKit improperly handles special files in build snapshots (CVSS 6.0, moby BuildKit)
- [CVE-2026-104979](https://cve.now/CVE-2026-104979.md): Plane: Cross-tenant stored XSS in intake enables account takeover (CVSS 8.7, makeplane plane)
- [CVE-2026-104978](https://cve.now/CVE-2026-104978.md): Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance (CVSS 8.2, makeplane plane)
- [CVE-2026-78413](https://cve.now/CVE-2026-78413.md): Velociraptor privilege escalation via SysmonLogForward client monitoring artifact (CVSS 5.5, Rapid7 Velociraptor)
- [CVE-2026-104977](https://cve.now/CVE-2026-104977.md): Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is\_blocked\_ip (CGNAT/multicast) + DNS-rebinding TOCTOU (CVSS 7.7, makeplane plane)
- [CVE-2026-93319](https://cve.now/CVE-2026-93319.md): A malicious frontend can cause a daemon panic (CVSS 5.7, moby BuildKit)
- [CVE-2026-104976](https://cve.now/CVE-2026-104976.md): Plane: SSRF in Gitea OAuth (CVSS 8.7, makeplane plane)
- [CVE-2026-93318](https://cve.now/CVE-2026-93318.md): Cache poisoning via unvalidated image layer DiffIDs (CVSS 7.5, moby BuildKit)
- [CVE-2026-105385](https://cve.now/CVE-2026-105385.md): onetwothreeneth HospitalManagementSystem transaction\_details.php sql injection (CVSS 6.9, onetwothreeneth HospitalManagementSystem)
- [CVE-2026-104975](https://cve.now/CVE-2026-104975.md): Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints (CVSS 7.1, makeplane plane)
- [CVE-2026-93317](https://cve.now/CVE-2026-93317.md): Container blob cache can accept unverified content (CVSS 5.9, moby BuildKit)
- [CVE-2026-104974](https://cve.now/CVE-2026-104974.md): Plane: Disabled User Auto-Reactivation on Login (CVSS 8.1, makeplane plane)
- [CVE-2026-93316](https://cve.now/CVE-2026-93316.md): Starting daemon with --cdi-disabled flag can lead to panic on specific builds (CVSS 7.1, moby BuildKit)
- [CVE-2026-104973](https://cve.now/CVE-2026-104973.md): Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery (CVSS 7.6, makeplane plane)
- [CVE-2026-104905](https://cve.now/CVE-2026-104905.md): FacturaScripts \< 2026.7 PHP Object Injection via WidgetSelect (CVSS 6.1, NeoRazorX facturascripts)
- [CVE-2026-101919](https://cve.now/CVE-2026-101919.md): Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane (CVSS 8.8, Red Hat Multicluster Engine for Kubernetes)
- [CVE-2025-15643](https://cve.now/CVE-2025-15643.md): WordPress Adsmonetizer plugin \<= 3.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jose Fernandez Adsmonetizer)
- [CVE-2026-78411](https://cve.now/CVE-2026-78411.md): Velociraptor Server Metadata update with Insufficient Permission Check (CVSS 6.5, Rapid7 Velociraptor)
- [CVE-2026-105384](https://cve.now/CVE-2026-105384.md): UNION HospitalManagementSystem patient\_info.php sql injection (CVSS 6.9, UNION HospitalManagementSystem)
- [CVE-2026-42700](https://cve.now/CVE-2026-42700.md): WordPress Image Slider Widget plugin \<= 1.1.130 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Image Slider Widget)
- [CVE-2026-104971](https://cve.now/CVE-2026-104971.md): Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization (CVSS 8.5, makeplane plane)
- [CVE-2026-102576](https://cve.now/CVE-2026-102576.md): Quay: quay: dom-based cross-site scripting via unvalidated redirect\_url on signin page (CVSS 4.2, Red Hat Quay)
- [CVE-2026-102295](https://cve.now/CVE-2026-102295.md): Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter (CVSS 5.4, Red Hat Quay)
- [CVE-2026-105383](https://cve.now/CVE-2026-105383.md): onetwothreeneth HospitalManagementSystem controller.php sql injection (CVSS 6.9, onetwothreeneth HospitalManagementSystem)
- [CVE-2026-102282](https://cve.now/CVE-2026-102282.md): adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -\> local privilege escalation (CVSS 7.1, cthackers adm-zip · adm-zip)
- [CVE-2026-104970](https://cve.now/CVE-2026-104970.md): Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins (CVSS 8.1, makeplane plane)
- [CVE-2026-104969](https://cve.now/CVE-2026-104969.md): Plane: Cross-Tenant Cycle Issue Hijack via IDOR (CVSS 6.5, makeplane plane)
- [CVE-2026-104968](https://cve.now/CVE-2026-104968.md): Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/ (CVSS 8.7, makeplane plane)
- [CVE-2026-104967](https://cve.now/CVE-2026-104967.md): Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint (CVSS 5.4, makeplane plane)
- [CVE-2026-104966](https://cve.now/CVE-2026-104966.md): Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces (CVSS 8.7, makeplane plane)
- [CVE-2026-104965](https://cve.now/CVE-2026-104965.md): Plane: Cross-Tenant Issue Relation Creation via IDOR (CVSS 5.4, makeplane plane)
- [CVE-2026-104964](https://cve.now/CVE-2026-104964.md): Plane: Cross-Workspace Project Modification via Unscoped Project Lookup (CVSS 6.8, makeplane plane)
- [CVE-2026-78412](https://cve.now/CVE-2026-78412.md): WatchEvent API streams another organization's live events (CVSS 4.9, Rapid7 Velociraptor)
- [CVE-2026-104963](https://cve.now/CVE-2026-104963.md): Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member (CVSS 4.3, makeplane plane)
- [CVE-2026-104962](https://cve.now/CVE-2026-104962.md): Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads) (CVSS 6.5, makeplane plane)
- [CVE-2026-104961](https://cve.now/CVE-2026-104961.md): Plane: WorkspaceOwnerPermission missing is\_active check allows deactivated users to retain owner access (CVSS 5.4, makeplane plane)
- [CVE-2026-104960](https://cve.now/CVE-2026-104960.md): Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users (CVSS 6.5, makeplane plane)
- [CVE-2026-104956](https://cve.now/CVE-2026-104956.md): Plane: Unauthenticated ORM field-name injection via \`group\_by\`/\`sub\_group\_by\` on public deploy boards (DoS + blind oracle) (CVSS 5.3, makeplane plane)
- [CVE-2026-105382](https://cve.now/CVE-2026-105382.md): onetwothreeneth HospitalManagementSystem Account Administration controller.php update\_subaccount improper authorization (CVSS 6.9, onetwothreeneth HospitalManagementSystem)
- [CVE-2026-104955](https://cve.now/CVE-2026-104955.md): Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation) (CVSS 5.4, makeplane plane)
- [CVE-2026-104894](https://cve.now/CVE-2026-104894.md): Plane: Cross-Tenant Module Issue Linking via IDOR (CVSS 4.3, makeplane plane)
- [CVE-2026-104893](https://cve.now/CVE-2026-104893.md): Plane: Improper validation allows arbitrary modification of API token rate limits (CVSS 5.4, makeplane plane)
- [CVE-2026-12171](https://cve.now/CVE-2026-12171.md): auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF (CVSS 8.4, cookpete auto-changelog)
- [CVE-2026-86671](https://cve.now/CVE-2026-86671.md): In Eclipse Che versions 7.29.0 and later, the GET \`/api/scm/resolve\` and \`POST /api/factory/resolver\` endpoints pass an attacker-controlled (CVSS 8.4, Eclipse Foundation Eclipse Che)
- [CVE-2026-102779](https://cve.now/CVE-2026-102779.md): Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 (CVSS 6.9, joomlafry.com TF Content for Joomla)
- [CVE-2026-102777](https://cve.now/CVE-2026-102777.md): Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension \< 6.6.0 (CVSS 6.3, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-102426](https://cve.now/CVE-2026-102426.md): Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 (CVSS 5.3, joomshaper.com SP Page Builder (Pro) extension for Joomla)
- [CVE-2026-102778](https://cve.now/CVE-2026-102778.md): Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension \< 6.6.0 (CVSS 5.3, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-102780](https://cve.now/CVE-2026-102780.md): Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 (CVSS 6.9, joomlafry.com TF Content for Joomla)
- [CVE-2026-102776](https://cve.now/CVE-2026-102776.md): Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension \< 6.6.0 (CVSS 5.1, svenbluege.de Event Gallery for Joomla)
- [CVE-2026-102775](https://cve.now/CVE-2026-102775.md): Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 (CVSS 8.7, phoca.cz Phoca Cart extension for Joomla)
- [CVE-2026-102428](https://cve.now/CVE-2026-102428.md): Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK \< 8.3.16 (CVSS 9.3, ordasoft.com OrdaSoft Joomla CCK)
- [CVE-2026-104892](https://cve.now/CVE-2026-104892.md): Plane: Plaintext logging of API token (CVSS 8.7, makeplane plane)
- [CVE-2026-104891](https://cve.now/CVE-2026-104891.md): mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control (CVSS 7.5, douglasborthwick-crypto mppx-condition-gate · @insumermo… +3)
- [CVE-2026-104890](https://cve.now/CVE-2026-104890.md): Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution (CVSS 7.2, KunstmaanBundlesCMS · kunstmaan bundles-cms +3)
- [CVE-2026-105329](https://cve.now/CVE-2026-105329.md): TallCMS PluginManager ThemeManager.php code injection (CVSS 5.3, TallCMS)
- [CVE-2026-105397](https://cve.now/CVE-2026-105397.md): LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation (CVSS 5.1, ThimPress LearnPress)
- [CVE-2026-89039](https://cve.now/CVE-2026-89039.md): Arbitrary file read via the convert\_playwright\_script prompt in mcp-k6 (CVSS 6.5, Grafana mcp-k6)
- [CVE-2026-79820](https://cve.now/CVE-2026-79820.md): A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware. (CVSS 9.0, Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out…)
- [CVE-2026-105421](https://cve.now/CVE-2026-105421.md): WordPress Kit (formerly ConvertKit) for WooCommerce plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 5.3, Kit (formerly ConvertKit) for WooCommerce)
- [CVE-2026-92931](https://cve.now/CVE-2026-92931.md): CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK (CVSS 8.8, Progress Software @progress/sitefinity-nextjs-sdk)
- [CVE-2026-105315](https://cve.now/CVE-2026-105315.md): django-haystack more\_like\_this Template Tag elasticsearch\_backend.py \_to\_python eval injection (CVSS 5.1, django-haystack)
- [CVE-2026-77805](https://cve.now/CVE-2026-77805.md): Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic (CVSS 7.9, Progress Software Progress® Telerik® Fiddler® Classic)
- [CVE-2026-77804](https://cve.now/CVE-2026-77804.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic (CVSS 6.6, Progress Software Progress® Telerik® Fiddler® Classic)
- [CVE-2026-77803](https://cve.now/CVE-2026-77803.md): Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic (CVSS 3.6, Progress Software Progress® Telerik® Fiddler® Classic)
- [CVE-2026-77802](https://cve.now/CVE-2026-77802.md): HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic (CVSS 6.3, Progress Software Progress® Telerik® Fiddler® Classic)
- [CVE-2026-39783](https://cve.now/CVE-2026-39783.md): WordPress Polylang plugin \<= 3.8.7 - Sensitive Data Exposure vulnerability (CVSS 4.3, WP SYNTEX Polylang)
- [CVE-2026-103684](https://cve.now/CVE-2026-103684.md): WordPress WP Event Solution plugin \<= 4.1.25 - Broken Access Control vulnerability (CVSS 5.3, Arraytics WP Event Solution)
- [CVE-2026-105073](https://cve.now/CVE-2026-105073.md): WordPress WP Event Solution plugin \<= 4.1.25 - Sensitive Data Exposure vulnerability (CVSS 5.3, Arraytics WP Event Solution)
- [CVE-2026-63270](https://cve.now/CVE-2026-63270.md): Environment/ini-file leaks (CVSS 6.7, The Document Foundation LibreOffice)
- [CVE-2026-63269](https://cve.now/CVE-2026-63269.md): LFI and GET SSRF via GStreamer and HLS playlists (CVSS 6.7, The Document Foundation LibreOffice)
- [CVE-2026-63268](https://cve.now/CVE-2026-63268.md): LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href (CVSS 6.7, The Document Foundation LibreOffice)
- [CVE-2026-63267](https://cve.now/CVE-2026-63267.md): LFI and GET SSRF via calcext:data-mappings and csv provider (CVSS 6.7, The Document Foundation LibreOffice)
- [CVE-2026-63266](https://cve.now/CVE-2026-63266.md): Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality (CVSS 6.8, The Document Foundation LibreOffice)
- [CVE-2026-63277](https://cve.now/CVE-2026-63277.md): RCE via calcext:data-mappings, sql provider and jdbc connector (CVSS 8.5, The Document Foundation LibreOffice)
- [CVE-2026-105307](https://cve.now/CVE-2026-105307.md): Casdoor API Endpoint authz\_filter.go ApiFilter missing authentication (CVSS 6.9, Casdoor)
- [CVE-2026-105396](https://cve.now/CVE-2026-105396.md): Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header (CVSS 5.3, heymrun heym)
- [CVE-2026-94669](https://cve.now/CVE-2026-94669.md): WordPress Fluent Forms Pro Add On Pack plugin \<= 6.2.13 - Broken Access Control vulnerability (CVSS 5.3, WP ManageNinja Fluent Forms Pro Add On Pack)
- [CVE-2026-105291](https://cve.now/CVE-2026-105291.md): feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting (CVSS 5.3, feelec-yishu feelcrm-os)
- [CVE-2026-105290](https://cve.now/CVE-2026-105290.md): feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery (CVSS 6.9, feelec-yishu feelcrm-os)
- [CVE-2026-59788](https://cve.now/CVE-2026-59788.md): Stored XSS vulnerability in OAuth configuration form (CVSS 5.6, Zabbix)
- [CVE-2026-59787](https://cve.now/CVE-2026-59787.md): SNMP trap injection in zabbix\_trap\_receiver.pl (CVSS 5.3, Zabbix)
- [CVE-2026-59786](https://cve.now/CVE-2026-59786.md): Active agent heartbeat missing TLS check (CVSS 6.9, Zabbix)
- [CVE-2026-59785](https://cve.now/CVE-2026-59785.md): Hidden host credentials inferable via multiselect.get filtering (CVSS 5.1, Zabbix)
- [CVE-2026-59783](https://cve.now/CVE-2026-59783.md): Server DoS via binary items (CVSS 2.3, Zabbix)
- [CVE-2026-59782](https://cve.now/CVE-2026-59782.md): JavaScript preprocessing memory disclosure (CVSS 6.9, Zabbix)
- [CVE-2026-39763](https://cve.now/CVE-2026-39763.md): WordPress WP Dummy Content Generator plugin \<= 4.0.0 - Broken Access Control vulnerability (CVSS 4.3, Deepak Anand WP Dummy Content Generator)
- [CVE-2026-105289](https://cve.now/CVE-2026-105289.md): feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars\_decode cross site scripting (CVSS 5.1, feelec-yishu feelcrm-os)
- [CVE-2026-105288](https://cve.now/CVE-2026-105288.md): feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting (CVSS 5.3, feelec-yishu feelcrm-os)
- [CVE-2026-105287](https://cve.now/CVE-2026-105287.md): feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection (CVSS 5.3, feelec-yishu feelcrm-os)
- [CVE-2026-105286](https://cve.now/CVE-2026-105286.md): Totolink A3002MU File Upload formUploadFile sub\_44B250 path traversal (CVSS 5.3, Totolink A3002MU)
- [CVE-2026-19395](https://cve.now/CVE-2026-19395.md): An empty \<img\> attribute value in styled text triggers a parser error that halts the device. (CVSS 6.6, Qt for MCUs)
- [CVE-2026-105285](https://cve.now/CVE-2026-105285.md): Totolink A3002MU QoS Rule formIpQoS stack-based overflow (CVSS 10.0, Totolink A3002MU)
- [CVE-2026-39721](https://cve.now/CVE-2026-39721.md): WordPress Starter Templates plugin \<= 4.7.7 - Broken Access Control vulnerability (CVSS 5.4, Brainstorm Force Starter Templates)
- [CVE-2026-105284](https://cve.now/CVE-2026-105284.md): Totolink A3002MU Authentication Check boa sub\_40FCFC improper authorization (CVSS 10.0, Totolink A3002MU)
- [CVE-2026-105064](https://cve.now/CVE-2026-105064.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.22 - Broken Access Control vulnerability (CVSS 6.5, Unlimited Elements For Elementor)
- [CVE-2026-103351](https://cve.now/CVE-2026-103351.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 2.1.1 - Other vulnerability Type vulnerability (CVSS 5.3, Magepeople Taxi Booking Manager for WooCommerce)
- [CVE-2026-104389](https://cve.now/CVE-2026-104389.md): WordPress Sirv plugin \<= 8.2.5 - SQL Injection vulnerability (CVSS 8.5, Sirv)
- [CVE-2026-104388](https://cve.now/CVE-2026-104388.md): WordPress PowerPress Podcasting plugin \<= 11.17.9 - Sensitive Data Exposure vulnerability (CVSS 5.3, Blubrry Podcasting PowerPress Podcasting)
- [CVE-2026-102393](https://cve.now/CVE-2026-102393.md): WordPress Starter Templates plugin \<= 4.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Starter Templates)
- [CVE-2026-103079](https://cve.now/CVE-2026-103079.md): WordPress JS Help Desk plugin \<= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Ahmad JS Help Desk)
- [CVE-2026-104396](https://cve.now/CVE-2026-104396.md): WordPress Name Directory plugin \<= 1.34.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jeroen Peters Name Directory)
- [CVE-2026-102914](https://cve.now/CVE-2026-102914.md): WordPress Presto Player plugin \<= 4.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Presto Player)
- [CVE-2026-104675](https://cve.now/CVE-2026-104675.md): WordPress Event Tickets plugin \<= 5.30.0 - Broken Access Control vulnerability (CVSS 4.3, Liquid Web / StellarWP Event Tickets)
- [CVE-2026-103084](https://cve.now/CVE-2026-103084.md): WordPress Premium Addons for Elementor plugin \<= 4.11.109 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LeapWorx Premium Addons for Elementor)
- [CVE-2026-104397](https://cve.now/CVE-2026-104397.md): WordPress Name Directory plugin \<= 1.34.2 - Arbitrary Shortcode Execution vulnerability (CVSS 5.3, Jeroen Peters Name Directory)
- [CVE-2026-105060](https://cve.now/CVE-2026-105060.md): WordPress Logo Showcase plugin \<= 4.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themepoints Logo Showcase)
- [CVE-2026-104673](https://cve.now/CVE-2026-104673.md): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin \<= 5.14.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MP3 Audio Player for Music, Radio & Podcast by Sonaar)
- [CVE-2026-105056](https://cve.now/CVE-2026-105056.md): WordPress eCommerce Product Catalog plugin \<= 3.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, impleCode eCommerce Product Catalog)
- [CVE-2026-105263](https://cve.now/CVE-2026-105263.md): Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery (CVSS 5.1, Shaarli)
- [CVE-2026-103510](https://cve.now/CVE-2026-103510.md): Authentication bypass via blank auth token in P4Search (CVSS 9.5, Perforce P4)
- [CVE-2026-104408](https://cve.now/CVE-2026-104408.md): WordPress Groundhogg plugin \<= 4.8.3 - SQL Injection vulnerability (CVSS 7.6, Groundhogg)
- [CVE-2026-103335](https://cve.now/CVE-2026-103335.md): WordPress Video Conferencing with Zoom plugin \<= 4.6.10 - Sensitive Data Exposure vulnerability (CVSS 5.3, Deepen Bajracharya Video Conferencing with Zoom)
- [CVE-2026-105055](https://cve.now/CVE-2026-105055.md): WordPress WP Mailster plugin \<= 1.9.0.0 - Broken Access Control vulnerability (CVSS 5.3, WP Mailster)
- [CVE-2026-103511](https://cve.now/CVE-2026-103511.md): Arbitrary file-write via extension installation in P4Search (CVSS 5.1, Perforce P4)
- [CVE-2026-97071](https://cve.now/CVE-2026-97071.md): WordPress CURCY plugin \<= 2.2.17 - Broken Access Control vulnerability (CVSS 5.3, VillaTheme CURCY)
- [CVE-2026-105062](https://cve.now/CVE-2026-105062.md): WordPress WP Admin Audit plugin \<= 1.2.17 - Broken Access Control vulnerability (CVSS 4.3, Brandtoss WP Admin Audit)
- [CVE-2026-103078](https://cve.now/CVE-2026-103078.md): WordPress JS Help Desk plugin \<= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Ahmad JS Help Desk)
- [CVE-2026-103512](https://cve.now/CVE-2026-103512.md): Ticket host-binding bypass via spoofed client IP in P4Search (CVSS 5.3, Perforce P4)
- [CVE-2026-104407](https://cve.now/CVE-2026-104407.md): WordPress PowerPress Podcasting plugin \<= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Blubrry Podcasting PowerPress Podcasting)
- [CVE-2026-104811](https://cve.now/CVE-2026-104811.md): Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution (CVSS 8.4, Mitel MiVoice Office)
- [CVE-2026-104386](https://cve.now/CVE-2026-104386.md): WordPress WP VR plugin \<= 9.1.3 - Broken Access Control vulnerability (CVSS 6.5, WPFunnels Team WP VR)
- [CVE-2026-104810](https://cve.now/CVE-2026-104810.md): Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability (CVSS 8.4, Mitel MiVoice Office)
- [CVE-2026-105069](https://cve.now/CVE-2026-105069.md): WordPress QR Redirector plugin \<= 2.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nikki Blight QR Redirector)
- [CVE-2026-104809](https://cve.now/CVE-2026-104809.md): Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution (CVSS 8.4, Mitel MiVoice Office)
- [CVE-2026-104404](https://cve.now/CVE-2026-104404.md): WordPress GiveWP plugin \<= 4.17.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Liquid Web / StellarWP GiveWP)
- [CVE-2026-103507](https://cve.now/CVE-2026-103507.md): Arbitrary file-write via log configuration path in P4Search (CVSS 7.5, Perforce P4)
- [CVE-2026-104808](https://cve.now/CVE-2026-104808.md): Mitel MiVoice Office 400 stored Cross-Site Scripting (CVSS 1.9, Mitel MiVoice Office)
- [CVE-2026-105254](https://cve.now/CVE-2026-105254.md): itsourcecode Online Admission System schoolyear.php sql injection (CVSS 5.3, itsourcecode Online Admission System)
- [CVE-2026-104807](https://cve.now/CVE-2026-104807.md): Mitel MiVoice Office 400 stored Cross-Site Scripting (CVSS 1.9, Mitel MiVoice Office)
- [CVE-2026-100102](https://cve.now/CVE-2026-100102.md): RCE via exposed JDWP debug agent in P4Search (CVSS 9.5, Perforce P4)
- [CVE-2026-105068](https://cve.now/CVE-2026-105068.md): WordPress Events Manager plugin \<= 7.4.5 - Sensitive Data Exposure vulnerability (CVSS 5.3, Pixelite Events Manager)
- [CVE-2026-104806](https://cve.now/CVE-2026-104806.md): Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure (CVSS 5.5, Mitel MiVoice Office)
- [CVE-2026-104805](https://cve.now/CVE-2026-104805.md): Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution (CVSS 8.5, Mitel MiVoice Office)
- [CVE-2026-100103](https://cve.now/CVE-2026-100103.md): Authentication bypass via default auth token in P4Search (CVSS 10.0, Perfoce P4)
- [CVE-2026-104401](https://cve.now/CVE-2026-104401.md): WordPress Memberful - Membership Plugin plugin \<= 1.81.2 - Sensitive Data Exposure vulnerability (CVSS 4.3, Memberful - Membership Plugin)
- [CVE-2026-104706](https://cve.now/CVE-2026-104706.md): Mitel MiVoice Office 400 view system files path traversal (CVSS 8.4, Mitel MiVoice Office)
- [CVE-2026-105253](https://cve.now/CVE-2026-105253.md): itsourcecode Online Admission System Project login1.php sql injection (CVSS 6.9, itsourcecode Online Admission System Project)
- [CVE-2026-104400](https://cve.now/CVE-2026-104400.md): WordPress B Blocks plugin \<= 2.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins B Blocks)
- [CVE-2026-19185](https://cve.now/CVE-2026-19185.md): Unvalidated user-supplied buffer pointers in the I3C do\_ccc system call handler allow kernel memory read/write from user mode (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-19184](https://cve.now/CVE-2026-19184.md): Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch (CVSS 8.4, zephyrproject zephyr)
- [CVE-2026-104409](https://cve.now/CVE-2026-104409.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Chill Image Photo Gallery Final Tiles Grid)
- [CVE-2026-105251](https://cve.now/CVE-2026-105251.md): vgmstream VAG File psx\_decoder.c ps\_find\_padding out-of-bounds (CVSS 5.3, vgmstream)
- [CVE-2026-105250](https://cve.now/CVE-2026-105250.md): vgmstream Microsoft IMA Decoder ima\_decoder.c decode\_ms\_ima divide by zero (CVSS 5.3, vgmstream)
- [CVE-2026-105249](https://cve.now/CVE-2026-105249.md): vgmstream TXTP File txtp\_process.c make\_group\_random use after free (CVSS 2.4, vgmstream)
- [CVE-2026-105314](https://cve.now/CVE-2026-105314.md): Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. (CVSS 7.5, Papermerge)
- [CVE-2026-105248](https://cve.now/CVE-2026-105248.md): vgmstream TXTP File txtp\_parser.c txtp\_parse out-of-bounds write (CVSS 5.3, vgmstream)
- [CVE-2026-105247](https://cve.now/CVE-2026-105247.md): SourceCodester Online Reviewer Management System btn\_functions.php course sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-19954](https://cve.now/CVE-2026-19954.md): Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names (CVSS 5.4, Net-Whois-Raw)
- [CVE-2019-25777](https://cve.now/CVE-2019-25777.md): YAML versions before 1.27\_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution (CVSS 7.3, YAML)
- [CVE-2017-20285](https://cve.now/CVE-2017-20285.md): YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes (CVSS 9.1, YAML)
- [CVE-2026-105246](https://cve.now/CVE-2026-105246.md): SourceCodester Online Reviewer Management System btn\_functions.php update sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-100727](https://cve.now/CVE-2026-100727.md): An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public page (CVSS 5.3, GROWI)
- [CVE-2026-105245](https://cve.now/CVE-2026-105245.md): sgl-project sglang HTTP Endpoint http\_server.py server\_info cleartext transmission (CVSS 6.3, sgl-project sglang)
- [CVE-2026-105238](https://cve.now/CVE-2026-105238.md): ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery (CVSS 6.9, ChatGPTNextWeb NextChat)
- [CVE-2026-78371](https://cve.now/CVE-2026-78371.md): File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure (CVSS 5.9, File Uploads Addon for WooCommerce)
- [CVE-2026-13607](https://cve.now/CVE-2026-13607.md): File Uploads Addon for WooCommerce \<= 1.7.6 - Unauthenticated Direct File Access (CVSS 5.9, File Uploads Addon for WooCommerce)
- [CVE-2026-84169](https://cve.now/CVE-2026-84169.md): UPI QR Code Payment Gateway \<= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery (CVSS 5.3, UPI QR Code Payment Gateway)
- [CVE-2026-105237](https://cve.now/CVE-2026-105237.md): linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication (CVSS 6.3, linlinjava litemall)
- [CVE-2026-105306](https://cve.now/CVE-2026-105306.md): Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-105302](https://cve.now/CVE-2026-105302.md): Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens (CVSS 5.7, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-105233](https://cve.now/CVE-2026-105233.md): kishor-23 food-waste-management-system Login Flow login.php session fixiation (CVSS 5.3, kishor-23 food-waste-management-system)
- [CVE-2026-105232](https://cve.now/CVE-2026-105232.md): kishor-23 food-waste-management-system Registration deliverysignup.php sql injection (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105231](https://cve.now/CVE-2026-105231.md): kishor-23 food-waste-management-system Admin Registration signup.php sql injection (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105230](https://cve.now/CVE-2026-105230.md): kishor-23 food-waste-management-system deliverymyord.php sql injection (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105229](https://cve.now/CVE-2026-105229.md): kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection (CVSS 6.9, kishor-23 food-waste-management-system)
- [CVE-2026-105226](https://cve.now/CVE-2026-105226.md): osCommerce osCommerce2 Newsletter Management newsletters.php include code injection (CVSS 5.1, osCommerce2)
- [CVE-2026-105225](https://cve.now/CVE-2026-105225.md): osCommerce osCommerce2 Payment payment.php include code injection (CVSS 4.8, osCommerce2)
- [CVE-2026-105188](https://cve.now/CVE-2026-105188.md): code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting (CVSS 5.1, code-projects Human Resource Management System)
- [CVE-2026-105187](https://cve.now/CVE-2026-105187.md): itsourcecode Online Admission System key.php sql injection (CVSS 5.3, itsourcecode Online Admission System)
- [CVE-2026-105186](https://cve.now/CVE-2026-105186.md): itsourcecode Online Admission System new.php sql injection (CVSS 5.3, itsourcecode Online Admission System)
- [CVE-2026-105185](https://cve.now/CVE-2026-105185.md): itsourcecode Online Admission System examinee.php sql injection (CVSS 6.9, itsourcecode Online Admission System)
- [CVE-2026-105184](https://cve.now/CVE-2026-105184.md): itsourcecode Online Admission System creteria.php sql injection (CVSS 6.9, itsourcecode Online Admission System)
- [CVE-2026-105183](https://cve.now/CVE-2026-105183.md): itsourcecode Online Admission System confirm.php sql injection (CVSS 6.9, itsourcecode Online Admission System)
- [CVE-2026-105182](https://cve.now/CVE-2026-105182.md): SourceCodester Online Reviewer Management System btn\_functions.php update sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-105181](https://cve.now/CVE-2026-105181.md): itsourcecode Online Admission System register1.php sql injection (CVSS 5.3, itsourcecode Online Admission System)
- [CVE-2026-105180](https://cve.now/CVE-2026-105180.md): Jeebase UserService info updateUser dynamically-determined object attributes (CVSS 5.3, Jeebase)
- [CVE-2026-105179](https://cve.now/CVE-2026-105179.md): SourceCodester Drug Recommendation System Password add\_user.php missing encryption (CVSS 5.1, SourceCodester Drug Recommendation System)
- [CVE-2026-20543](https://cve.now/CVE-2026-20543.md): In Modem, there is a possible information disclosure due to a logic error. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20542](https://cve.now/CVE-2026-20542.md): In apusys, there is a possible memory corruption due to use after free. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20541](https://cve.now/CVE-2026-20541.md): In Modem, there is a possible out of bounds read due to a missing permission check. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20540](https://cve.now/CVE-2026-20540.md): In Modem, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20539](https://cve.now/CVE-2026-20539.md): In Modem, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20538](https://cve.now/CVE-2026-20538.md): In Modem, there is a possible out of bounds read due to a missing permission check. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20537](https://cve.now/CVE-2026-20537.md): In aidl, there is a possible memory corruption due to use after free. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20536](https://cve.now/CVE-2026-20536.md): In aidl, there is a possible memory corruption due to use after free. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20535](https://cve.now/CVE-2026-20535.md): In aidl, there is a possible escalation of privilege due to a missing permission check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20534](https://cve.now/CVE-2026-20534.md): In Modem, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20533](https://cve.now/CVE-2026-20533.md): In display, there is a possible escalation of privilege due to an integer overflow. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20532](https://cve.now/CVE-2026-20532.md): In apu, there is a possible application crash due to double free. (CVSS 6.2, MediaTek chipset)
- [CVE-2026-20531](https://cve.now/CVE-2026-20531.md): In apu, there is a possible memory corruption due to use after free. (CVSS 8.4, MediaTek chipset)
- [CVE-2026-20530](https://cve.now/CVE-2026-20530.md): In display, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20529](https://cve.now/CVE-2026-20529.md): In battery, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20528](https://cve.now/CVE-2026-20528.md): In ccci, there is a possible out of bounds write and read due to a missing bounds check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20544](https://cve.now/CVE-2026-20544.md): In meta, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.8, MediaTek chipset)
- [CVE-2026-20588](https://cve.now/CVE-2026-20588.md): In mtee, there is a possible escalation of privilege due to a missing bounds check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20587](https://cve.now/CVE-2026-20587.md): In mtee, there is a possible escalation of privilege due to type confusion. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20579](https://cve.now/CVE-2026-20579.md): In vdec, there is a possible out of bounds write due to type confusion. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20527](https://cve.now/CVE-2026-20527.md): In Modem, there is a possible system crash due to a missing bounds check. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20526](https://cve.now/CVE-2026-20526.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.5, MediaTek chipset)
- [CVE-2026-20525](https://cve.now/CVE-2026-20525.md): In Modem, there is a possible system crash due to improper input validation. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20524](https://cve.now/CVE-2026-20524.md): In apu, there is a possible memory corruption due to improper input validation. (CVSS 8.4, MediaTek chipset)
- [CVE-2026-20523](https://cve.now/CVE-2026-20523.md): In neuropilot, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.4, MediaTek chipset)
- [CVE-2026-20522](https://cve.now/CVE-2026-20522.md): In neuropilot, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.4, MediaTek chipset)
- [CVE-2026-20521](https://cve.now/CVE-2026-20521.md): In Video HAL, there is a possible escalation of privilege due to a missing bounds check. (CVSS 8.4, MediaTek chipset)
- [CVE-2026-20589](https://cve.now/CVE-2026-20589.md): In venc, there is a possible out of bounds write due to type confusion. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20586](https://cve.now/CVE-2026-20586.md): In vdec, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, MediaTek chipset)
- [CVE-2026-20520](https://cve.now/CVE-2026-20520.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.5, MediaTek chipset)
- [CVE-2026-20519](https://cve.now/CVE-2026-20519.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.5, MediaTek chipset)
- [CVE-2026-105178](https://cve.now/CVE-2026-105178.md): SourceCodester Drug Recommendation System Symptom Creation add\_symptom.php mysqli\_real\_escape\_string sql injection (CVSS 5.1, SourceCodester Drug Recommendation System)
- [CVE-2026-105177](https://cve.now/CVE-2026-105177.md): SourceCodester Drug Recommendation System Drug Creation add\_drug.php sql injection (CVSS 5.1, SourceCodester Drug Recommendation System)
- [CVE-2026-105176](https://cve.now/CVE-2026-105176.md): SourceCodester Drug Recommendation System edit\_class.php sql injection (CVSS 5.1, SourceCodester Drug Recommendation System)
- [CVE-2026-105175](https://cve.now/CVE-2026-105175.md): SourceCodester Drug Recommendation System Student Registration add\_student.php sql injection (CVSS 6.9, SourceCodester Drug Recommendation System)
- [CVE-2026-105295](https://cve.now/CVE-2026-105295.md): GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass (CVSS 7.7, GitAhead)
- [CVE-2026-105294](https://cve.now/CVE-2026-105294.md): Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig (CVSS 9.1, Legcord)
- [CVE-2026-105293](https://cve.now/CVE-2026-105293.md): Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers (CVSS 9.2, Legcord)
- [CVE-2026-105292](https://cve.now/CVE-2026-105292.md): Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback (CVSS 6.0, Chaterm)
- [CVE-2026-105223](https://cve.now/CVE-2026-105223.md): maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification (CVSS 9.1, maclof kubernetes-client)
- [CVE-2026-105174](https://cve.now/CVE-2026-105174.md): Gerapy Project Management views.py project\_create path traversal (CVSS 5.3, Gerapy)
- [CVE-2026-105173](https://cve.now/CVE-2026-105173.md): code-projects Human Resource Management Event Creation EventStore.php cross site scripting (CVSS 5.1, code-projects Human Resource Management)
- [CVE-2026-105172](https://cve.now/CVE-2026-105172.md): itsourcecode Online Admission System login1.php sql injection (CVSS 6.9, itsourcecode Online Admission System)
- [CVE-2026-37719](https://cve.now/CVE-2026-37719.md): An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component. (CVSS 9.8)
- [CVE-2026-78860](https://cve.now/CVE-2026-78860.md): An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext (CVSS 7.8)
- [CVE-2026-78861](https://cve.now/CVE-2026-78861.md): An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key (CVSS 7.7)
- [CVE-2026-78862](https://cve.now/CVE-2026-78862.md): An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (P (CVSS 6.8)
- [CVE-2026-88391](https://cve.now/CVE-2026-88391.md): Northstar (dromara/northstar, quantitative trading platform) \<= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar (CVSS 9.8)
- [CVE-2026-88392](https://cve.now/CVE-2026-88392.md): Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). (CVSS 7.5)
- [CVE-2026-88393](https://cve.now/CVE-2026-88393.md): WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. (CVSS 9.8)
- [CVE-2026-88394](https://cve.now/CVE-2026-88394.md): WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. (CVSS 7.5)
- [CVE-2026-88395](https://cve.now/CVE-2026-88395.md): GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter. (CVSS 9.8)
- [CVE-2026-88396](https://cve.now/CVE-2026-88396.md): ApiAdmin v5.0 and before is vulnerable to Directory Traversal. (CVSS 7.2)
- [CVE-2026-88397](https://cve.now/CVE-2026-88397.md): ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter. (CVSS 6.5)
- [CVE-2026-88424](https://cve.now/CVE-2026-88424.md): FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). (CVSS 9.8)
- [CVE-2026-95165](https://cve.now/CVE-2026-95165.md): Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field. (CVSS 6.1)
- [CVE-2026-95166](https://cve.now/CVE-2026-95166.md): In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload. (CVSS 5.4)
- [CVE-2026-95263](https://cve.now/CVE-2026-95263.md): Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. (CVSS 7.2)
- [CVE-2026-95264](https://cve.now/CVE-2026-95264.md): Feehi CMS 2.1.1 is vulnerable to Directory Traversal. (CVSS 6.5)
- [CVE-2026-95265](https://cve.now/CVE-2026-95265.md): Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.