# CVEs published 2026-10-07

330 CVEs were published on October 7, 2026: 51 critical, 119 high. Days are UTC.

- [CVE-2026-17538](https://cve.now/CVE-2026-17538.md): Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress \<= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification (CVSS 5.4, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-94154](https://cve.now/CVE-2026-94154.md): Aurora Heatmap \<= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter (CVSS 6.1, r3098 Aurora Heatmap)
- [CVE-2026-107315](https://cve.now/CVE-2026-107315.md): pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros) (CVSS 5.3, pgjdbc)
- [CVE-2026-107314](https://cve.now/CVE-2026-107314.md): pgjdbc does not enforce requireAuth when the value excludes every authentication method (CVSS 5.9, pgjdbc)
- [CVE-2026-89322](https://cve.now/CVE-2026-89322.md): Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions (CVSS 7.2, HashiCorp Vault · vault)
- [CVE-2026-105820](https://cve.now/CVE-2026-105820.md): Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution (CVSS 5.4, HashiCorp Vault Enterprise)
- [CVE-2026-105816](https://cve.now/CVE-2026-105816.md): Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots (CVSS 8.0, HashiCorp Vault · vault)
- [CVE-2026-107285](https://cve.now/CVE-2026-107285.md): AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel (CVSS 5.9, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107284](https://cve.now/CVE-2026-107284.md): AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check (CVSS 3.7, AsyncHttpClient async-http-client)
- [CVE-2026-107283](https://cve.now/CVE-2026-107283.md): AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source (CVSS 3.7, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107282](https://cve.now/CVE-2026-107282.md): AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host (CVSS 9.4, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-105818](https://cve.now/CVE-2026-105818.md): Vault PKI ACME Issues Certificate With Unvalidated SANs (CVSS 5.9, HashiCorp Vault · vault)
- [CVE-2026-107281](https://cve.now/CVE-2026-107281.md): AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities (CVSS 7.6, AsyncHttpClient async-http-client)
- [CVE-2026-107280](https://cve.now/CVE-2026-107280.md): AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk (CVSS 6.9, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107279](https://cve.now/CVE-2026-107279.md): AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int (CVSS 8.8, AsyncHttpClient async-http-client)
- [CVE-2026-107232](https://cve.now/CVE-2026-107232.md): AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT (CVSS 7.5, AsyncHttpClient async-http-client)
- [CVE-2026-107231](https://cve.now/CVE-2026-107231.md): AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext (CVSS 8.7, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107230](https://cve.now/CVE-2026-107230.md): AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins (CVSS 7.4, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107229](https://cve.now/CVE-2026-107229.md): AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts (CVSS 4.0, AsyncHttpClient async-http-client)
- [CVE-2026-107228](https://cve.now/CVE-2026-107228.md): AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) (CVSS 6.8, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107227](https://cve.now/CVE-2026-107227.md): AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled (CVSS 7.5, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-76286](https://cve.now/CVE-2026-76286.md): Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server (CVSS 5.3, Splunk MCP Server)
- [CVE-2026-76285](https://cve.now/CVE-2026-76285.md): Improper Adherence to Coding Standards in Splunk Enterprise (CVSS 9.8, Splunk Enterprise)
- [CVE-2026-76284](https://cve.now/CVE-2026-76284.md): Improper Neutralization in Splunk Enterprise (CVSS 9.8, Splunk Enterprise)
- [CVE-2026-76283](https://cve.now/CVE-2026-76283.md): Protection Mechanism Failure in Splunk Enterprise (CVSS 7.6, Splunk Enterprise)
- [CVE-2026-76282](https://cve.now/CVE-2026-76282.md): Improper Control of a Resource Through its Lifetime in Splunk Enterprise (CVSS 8.8, Splunk Enterprise)
- [CVE-2026-76281](https://cve.now/CVE-2026-76281.md): Improper Access Control in Splunk Enterprise (CVSS 5.3, Splunk Enterprise)
- [CVE-2026-76280](https://cve.now/CVE-2026-76280.md): Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway (CVSS 6.3, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2026-76279](https://cve.now/CVE-2026-76279.md): Improper Input Validation of Index Names through the collect Command in Splunk Enterprise (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-76278](https://cve.now/CVE-2026-76278.md): Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-76277](https://cve.now/CVE-2026-76277.md): Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise (CVSS 4.1, Splunk Enterprise)
- [CVE-2026-76276](https://cve.now/CVE-2026-76276.md): Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-76275](https://cve.now/CVE-2026-76275.md): Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-76274](https://cve.now/CVE-2026-76274.md): Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud (CVSS 6.5, Splunk Enterprise)
- [CVE-2026-76273](https://cve.now/CVE-2026-76273.md): Improper Input Validation through the collect Command in Splunk Enterprise (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-76272](https://cve.now/CVE-2026-76272.md): Missing Access Control through the REST API in Splunk Secure Gateway (CVSS 4.3, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2026-76271](https://cve.now/CVE-2026-76271.md): Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise (CVSS 6.5, Splunk Enterprise)
- [CVE-2026-76270](https://cve.now/CVE-2026-76270.md): Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise (CVSS 6.5, Splunk Enterprise)
- [CVE-2026-76269](https://cve.now/CVE-2026-76269.md): Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise (CVSS 6.5, Splunk Enterprise)
- [CVE-2026-76268](https://cve.now/CVE-2026-76268.md): Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise (CVSS 9.8, Splunk Enterprise)
- [CVE-2026-76267](https://cve.now/CVE-2026-76267.md): Log Injection through the REST API in Splunk App for Splunk O11y Cloud (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-76266](https://cve.now/CVE-2026-76266.md): Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise (CVSS 7.7, Splunk Enterprise)
- [CVE-2026-76265](https://cve.now/CVE-2026-76265.md): Improper Access Control through REST API Endpoints in Splunk Secure Gateway (CVSS 6.5, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2026-76264](https://cve.now/CVE-2026-76264.md): Improper Authorization through the REST API in Splunk Enterprise (CVSS 4.3, Splunk Enterprise)
- [CVE-2026-107352](https://cve.now/CVE-2026-107352.md): Missing authorization checks in Amazon Athena engine version 3 request handling (CVSS 7.7, AWS Amazon Athena)
- [CVE-2026-107363](https://cve.now/CVE-2026-107363.md): In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent (CVSS 6.1, OpenStack Zaqar)
- [CVE-2026-1403](https://cve.now/CVE-2026-1403.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-97717](https://cve.now/CVE-2026-97717.md): Denial of Service in Absolute Secure Access (CVSS 6.0, Absolute Security Secure Access)
- [CVE-2026-97716](https://cve.now/CVE-2026-97716.md): Denial of Service in Absolute Secure Access (CVSS 8.7, Absolute Security Secure Access)
- [CVE-2026-34499](https://cve.now/CVE-2026-34499.md): Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. (CVSS 8.5, Johnson Controls ADVMS)
- [CVE-2026-107353](https://cve.now/CVE-2026-107353.md): traverse: set() can write to built-in prototypes via an untrusted path (CVSS 6.9, ljharb traverse)
- [CVE-2026-97715](https://cve.now/CVE-2026-97715.md): Denial of Service in Absolute Secure Access (CVSS 7.1, Absolute Security Secure Access)
- [CVE-2026-107176](https://cve.now/CVE-2026-107176.md): Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret (CVSS 6.8, Red Hat OpenShift Container Platform)
- [CVE-2026-107161](https://cve.now/CVE-2026-107161.md): Cyrus-sasl: heap buffer overflow in cyrus-sasl add\_to\_challenge() allows malicious server to crash or compromise digest-md5 clients (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-97714](https://cve.now/CVE-2026-97714.md): Denial of service vulnerability in Secure Access (CVSS 8.2, Absolute Security Secure Access)
- [CVE-2026-107225](https://cve.now/CVE-2026-107225.md): Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107224](https://cve.now/CVE-2026-107224.md): Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107223](https://cve.now/CVE-2026-107223.md): Excelize: Unbounded \<col max\> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process (CVSS 7.1, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-103371](https://cve.now/CVE-2026-103371.md): Apache Geode: Management REST API: Insertion of Sensitive Information into Log File (CVSS 7.5, Apache Software Foundation Apache Geode)
- [CVE-2026-107222](https://cve.now/CVE-2026-107222.md): Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107221](https://cve.now/CVE-2026-107221.md): Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107220](https://cve.now/CVE-2026-107220.md): Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref (CVSS 6.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107219](https://cve.now/CVE-2026-107219.md): Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107218](https://cve.now/CVE-2026-107218.md): Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics (CVSS 5.3, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107217](https://cve.now/CVE-2026-107217.md): Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-107313](https://cve.now/CVE-2026-107313.md): pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections (CVSS 4.2, pgjdbc)
- [CVE-2026-106164](https://cve.now/CVE-2026-106164.md): Infinite Loop in Telerik Document Processing XLS Import (CVSS 7.3, Progress Software Telerik Document Processing Libraries)
- [CVE-2026-107216](https://cve.now/CVE-2026-107216.md): Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-107215](https://cve.now/CVE-2026-107215.md): Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-56851](https://cve.now/CVE-2026-56851.md): Panic parsing crafted input in x/text/secure/precis in golang.org/x/text (CVSS 7.5, golang.org/x/text/secure/precis · golang.org/x/text)
- [CVE-2026-107214](https://cve.now/CVE-2026-107214.md): Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-107213](https://cve.now/CVE-2026-107213.md): Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element (CVSS 8.7, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-106067](https://cve.now/CVE-2026-106067.md): Gimp: gimp: heap buffer overflow in hot color filter on oversized image (CVSS 6.3, Red Hat Enterprise Linux)
- [CVE-2026-106066](https://cve.now/CVE-2026-106066.md): Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions (CVSS 6.3, Red Hat Enterprise Linux)
- [CVE-2026-107212](https://cve.now/CVE-2026-107212.md): Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-107211](https://cve.now/CVE-2026-107211.md): Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic (CVSS 8.7, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-96335](https://cve.now/CVE-2026-96335.md): WordPress Forminator plugin \<= 1.57.2 - Broken Access Control vulnerability (CVSS 7.5, WPMU DEV Forminator)
- [CVE-2026-95606](https://cve.now/CVE-2026-95606.md): WordPress The Events Calendar plugin \<= 6.17.4 - PHP Object Injection vulnerability (CVSS 9.8, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-95605](https://cve.now/CVE-2026-95605.md): WordPress WP Data Access plugin \<= 5.5.82 - SQL Injection vulnerability (CVSS 9.3, Passionate Programmer Peter WP Data Access)
- [CVE-2026-95595](https://cve.now/CVE-2026-95595.md): WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO…)
- [CVE-2026-95534](https://cve.now/CVE-2026-95534.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.19 - PHP Object Injection vulnerability (CVSS 8.8, Unlimited Elements For Elementor)
- [CVE-2026-94670](https://cve.now/CVE-2026-94670.md): WordPress Everest Forms plugin \<= 3.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Everest Forms)
- [CVE-2026-106065](https://cve.now/CVE-2026-106065.md): Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions (CVSS 6.3, Red Hat Enterprise Linux)
- [CVE-2026-94662](https://cve.now/CVE-2026-94662.md): WordPress Unlimited Elements For Elementor plugin \<= 2.0.19 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unlimited Elements For Elementor)
- [CVE-2026-92543](https://cve.now/CVE-2026-92543.md): Docker Engine insecure-registry fallback via malicious DNS responses (CVSS 7.6, Docker Engine · Moby)
- [CVE-2026-92542](https://cve.now/CVE-2026-92542.md): Blind VXLAN injection into encrypted overlay networks from cluster peer (CVSS 6.9, Docker Engine · Moby overlay network driver)
- [CVE-2026-106557](https://cve.now/CVE-2026-106557.md): Backstage: Improper input validation in TechDocs Markdown extension configuration (CVSS 7.7, backstage · @backstage plugin-techdocs-node +1)
- [CVE-2026-76472](https://cve.now/CVE-2026-76472.md): Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities (CVSS 8.8, Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2)
- [CVE-2026-76467](https://cve.now/CVE-2026-76467.md): Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities (CVSS 7.5, Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2)
- [CVE-2026-76470](https://cve.now/CVE-2026-76470.md): Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities (CVSS 8.8, Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2)
- [CVE-2026-76469](https://cve.now/CVE-2026-76469.md): Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management Vulnerabilities (CVSS 7.4, Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2)
- [CVE-2026-76468](https://cve.now/CVE-2026-76468.md): Cisco Meraki Hardening Release - Input Validation Vulnerabilities (CVSS 8.2, Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2)
- [CVE-2026-76464](https://cve.now/CVE-2026-76464.md): Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities (CVSS 9.6, Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2)
- [CVE-2026-76463](https://cve.now/CVE-2026-76463.md): Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities (CVSS 8.8, Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2)
- [CVE-2026-76501](https://cve.now/CVE-2026-76501.md): Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability (CVSS 9.8, Cisco NX-OS Software)
- [CVE-2026-76500](https://cve.now/CVE-2026-76500.md): Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities (CVSS 9.8, Cisco Application Policy Infrastructure Controller)
- [CVE-2026-76498](https://cve.now/CVE-2026-76498.md): Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities (CVSS 9.8, Cisco Application Policy Infrastructure Controller)
- [CVE-2026-76499](https://cve.now/CVE-2026-76499.md): Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities (CVSS 9.8, Cisco Application Policy Infrastructure Controller)
- [CVE-2026-76486](https://cve.now/CVE-2026-76486.md): Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability (CVSS 9.8, Cisco NX-OS Software)
- [CVE-2026-76488](https://cve.now/CVE-2026-76488.md): Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure Vulnerability (CVSS 6.5, Cisco Application Policy Infrastructure Controller)
- [CVE-2026-76484](https://cve.now/CVE-2026-76484.md): Cisco License On-Prem Security Hardening Release (CVSS 8.8, Cisco License On-Prem)
- [CVE-2026-76485](https://cve.now/CVE-2026-76485.md): Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability (CVSS 9.8, Cisco NX-OS Software)
- [CVE-2026-76483](https://cve.now/CVE-2026-76483.md): Cisco License On-Prem Security Hardening Release (CVSS 9.1, Cisco License On-Prem)
- [CVE-2026-76482](https://cve.now/CVE-2026-76482.md): Cisco License On-Prem Security Hardening Release (CVSS 10.0, Cisco License On-Prem)
- [CVE-2026-76480](https://cve.now/CVE-2026-76480.md): Cisco License On-Prem Security Hardening Release (CVSS 9.8, Cisco License On-Prem)
- [CVE-2026-76458](https://cve.now/CVE-2026-76458.md): Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions Vulnerabilities (CVSS 8.6, Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1)
- [CVE-2026-76459](https://cve.now/CVE-2026-76459.md): Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities (CVSS 9.8, Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1)
- [CVE-2026-76471](https://cve.now/CVE-2026-76471.md): Cisco NX-OS Software NX-API Remote Code Execution Vulnerability (CVSS 9.8, Cisco NX-OS Software · Cisco Unified Computing System)
- [CVE-2026-76455](https://cve.now/CVE-2026-76455.md): Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities (CVSS 9.8, Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1)
- [CVE-2026-76457](https://cve.now/CVE-2026-76457.md): Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities (CVSS 8.6, Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1)
- [CVE-2026-76456](https://cve.now/CVE-2026-76456.md): Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilities (CVSS 8.6, Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1)
- [CVE-2026-76465](https://cve.now/CVE-2026-76465.md): Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability (CVSS 9.8, Cisco NX-OS Software)
- [CVE-2026-101886](https://cve.now/CVE-2026-101886.md): Cisco Jabber for Android Path Traversal via Shared Content URI (CVSS 5.1, Cisco Jabber for Android)
- [CVE-2026-62252](https://cve.now/CVE-2026-62252.md): Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login (CVSS 9.8, sipcapture homer · github.com/sipcapture/homer-app)
- [CVE-2026-76454](https://cve.now/CVE-2026-76454.md): Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability (CVSS 9.1, Cisco License On-Prem)
- [CVE-2026-76453](https://cve.now/CVE-2026-76453.md): Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilities (CVSS 8.8, Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1)
- [CVE-2026-76437](https://cve.now/CVE-2026-76437.md): Cisco Smart Software Manager On-Prem Command Injection Vulnerability (CVSS 4.9, Cisco License On-Prem)
- [CVE-2026-20362](https://cve.now/CVE-2026-20362.md): Cisco Finesse Server-Side Request Forgery Vulnerability (CVSS 7.2, Cisco Finesse)
- [CVE-2026-76452](https://cve.now/CVE-2026-76452.md): Cisco Smart Software Manager On-Prem SQL Injection Vulnerability (CVSS 4.9, Cisco License On-Prem)
- [CVE-2026-20173](https://cve.now/CVE-2026-20173.md): Cisco NX-OS Software Denial of Service Vulnerability (CVSS 5.8, Cisco NX-OS Software)
- [CVE-2026-20328](https://cve.now/CVE-2026-20328.md): Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability (CVSS 9.1, Cisco License On-Prem)
- [CVE-2026-20032](https://cve.now/CVE-2026-20032.md): Cisco NX-OS Software Python Sandbox Escape Vulnerability (CVSS 4.4, Cisco NX-OS Software)
- [CVE-2026-20038](https://cve.now/CVE-2026-20038.md): Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass Vulnerability (CVSS 5.8, Cisco NX-OS System Software in ACI Mode)
- [CVE-2026-20321](https://cve.now/CVE-2026-20321.md): Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability (CVSS 6.5, Cisco Application Policy Infrastructure Controller)
- [CVE-2026-62253](https://cve.now/CVE-2026-62253.md): Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) (CVSS 9.8, sipcapture homer · github.com/sipcapture/homer-app)
- [CVE-2026-62251](https://cve.now/CVE-2026-62251.md): Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query (CVSS 8.1, sipcapture homer · github.com/sipcapture/homer-app)
- [CVE-2026-62176](https://cve.now/CVE-2026-62176.md): PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation (CVSS 9.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-107166](https://cve.now/CVE-2026-107166.md): Open5GS GTP-U Receive Path gtp-path.c ogs\_pfcp\_xact\_local\_create allocation of resources (CVSS 6.9, Open5GS)
- [CVE-2026-107210](https://cve.now/CVE-2026-107210.md): ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data (CVSS 5.3, ImageMagick)
- [CVE-2026-107209](https://cve.now/CVE-2026-107209.md): ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support (CVSS 5.9, ImageMagick)
- [CVE-2026-107208](https://cve.now/CVE-2026-107208.md): ImageMagick: Denial of service with crafted XMP profile (CVSS 5.3, ImageMagick)
- [CVE-2026-106580](https://cve.now/CVE-2026-106580.md): ImageMagick: Policy Bypass in CUT encoder (CVSS 4.0, ImageMagick)
- [CVE-2026-92415](https://cve.now/CVE-2026-92415.md): Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies (CVSS 6.9, Apache Software Foundation Apache Jackrabbit)
- [CVE-2026-92414](https://cve.now/CVE-2026-92414.md): Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (CVSS 9.3, Apache Software Foundation Apache Jackrabbit)
- [CVE-2026-106579](https://cve.now/CVE-2026-106579.md): ImageMagick: Policy Bypass when using coder as the domain. (CVSS 6.2, ImageMagick)
- [CVE-2026-107273](https://cve.now/CVE-2026-107273.md): Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site (CVSS 5.3, gophish)
- [CVE-2026-107272](https://cve.now/CVE-2026-107272.md): Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages (CVSS 2.3, gophish)
- [CVE-2026-107271](https://cve.now/CVE-2026-107271.md): Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing (CVSS 6.9, gophish)
- [CVE-2026-107270](https://cve.now/CVE-2026-107270.md): Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints (CVSS 7.1, gophish)
- [CVE-2026-107278](https://cve.now/CVE-2026-107278.md): MISP Object Sync Drops Objects and Attributes When Description Is Empty (CVSS 5.3, MISP)
- [CVE-2026-106578](https://cve.now/CVE-2026-106578.md): ImageMagick: Invalid Memory Free in MVG decoder (CVSS 5.9, ImageMagick)
- [CVE-2026-107269](https://cve.now/CVE-2026-107269.md): Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy (CVSS 6.3, gophish)
- [CVE-2026-106577](https://cve.now/CVE-2026-106577.md): ImageMagick: Code Injection in the postscript coders (CVSS 5.3, ImageMagick)
- [CVE-2026-106576](https://cve.now/CVE-2026-106576.md): ImageMagick: Denial of service possible when parsing an XMP profile. (CVSS 5.3, ImageMagick)
- [CVE-2026-107276](https://cve.now/CVE-2026-107276.md): MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests (CVSS 6.3, MISP)
- [CVE-2026-106575](https://cve.now/CVE-2026-106575.md): ImageMagick: Unclosed file pointer in magick script (CVSS 5.3, ImageMagick)
- [CVE-2026-106574](https://cve.now/CVE-2026-106574.md): ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash (CVSS 5.3, ImageMagick)
- [CVE-2026-106573](https://cve.now/CVE-2026-106573.md): ImageMagick: Denial of service in MVG decoder (CVSS 5.3, ImageMagick)
- [CVE-2026-106572](https://cve.now/CVE-2026-106572.md): ImageMagick: Stack Overflown CALS decoder due to missing depth check. (CVSS 5.3, ImageMagick)
- [CVE-2026-106571](https://cve.now/CVE-2026-106571.md): ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crash (CVSS 5.1, ImageMagick)
- [CVE-2026-106570](https://cve.now/CVE-2026-106570.md): ImageMagick: Denial of service in distributed pixel cache server (CVSS 4.3, ImageMagick)
- [CVE-2026-106569](https://cve.now/CVE-2026-106569.md): ImageMagick: Denial of service in ASE decoder because of missing security checks (CVSS 5.3, ImageMagick)
- [CVE-2026-106568](https://cve.now/CVE-2026-106568.md): ImageMagick: Infinite Loop when reading a crafted XMP profile (CVSS 5.3, ImageMagick)
- [CVE-2026-107207](https://cve.now/CVE-2026-107207.md): LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass (CVSS 6.9, LMCache)
- [CVE-2026-107206](https://cve.now/CVE-2026-107206.md): LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API (CVSS 8.8, LMCache)
- [CVE-2026-107205](https://cve.now/CVE-2026-107205.md): LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API (CVSS 8.8, LMCache)
- [CVE-2026-107204](https://cve.now/CVE-2026-107204.md): LMCache through 0.5.5 Unauthenticated RCE via /run\_script Endpoint (CVSS 9.3, LMCache)
- [CVE-2026-106567](https://cve.now/CVE-2026-106567.md): ImageMagick: Infinite Loop in PSD decoder on 32-bit builds (CVSS 5.9, ImageMagick)
- [CVE-2026-106566](https://cve.now/CVE-2026-106566.md): ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check (CVSS 4.0, ImageMagick)
- [CVE-2026-106565](https://cve.now/CVE-2026-106565.md): ImageMagick: Infinite Loop in bzip2 compressed images. (CVSS 5.9, ImageMagick)
- [CVE-2026-106564](https://cve.now/CVE-2026-106564.md): ImageMagick: Heap Buffer Over-Write in EXR decoder (CVSS 5.3, ImageMagick)
- [CVE-2026-33586](https://cve.now/CVE-2026-33586.md): Authenticated SMTP Sender Address Forgery (CVSS 6.3, OVHcloud)
- [CVE-2026-106563](https://cve.now/CVE-2026-106563.md): Backstage: Improper entity validation in deprecated Kubernetes services endpoint (CVSS 5.3, backstage · @backstage plugin-kubernetes-backend +1)
- [CVE-2026-106562](https://cve.now/CVE-2026-106562.md): Backstage: Incorrect authorization in search engine permission filtering (CVSS 4.3, backstage · @backstage plugin-search-backend +3)
- [CVE-2026-106561](https://cve.now/CVE-2026-106561.md): Backstage: Sensitive information disclosure in Kubernetes resource queries (CVSS 5.0, backstage · @backstage plugin-kubernetes-backend +1)
- [CVE-2026-106560](https://cve.now/CVE-2026-106560.md): Backstage: Improper repository path validation in a Scaffolder backend module (CVSS 7.1, backstage · @backstage plugin-scaffolder-backend-module-… +1)
- [CVE-2026-106559](https://cve.now/CVE-2026-106559.md): Backstage: Improper input validation in Confluence to Markdown scaffolder module (CVSS 6.3, backstage · @backstage plugin-scaffolder-backend-module-… +1)
- [CVE-2026-106558](https://cve.now/CVE-2026-106558.md): Backstage: Improper validation of TechDocs MkDocs configuration (CVSS 8.8, backstage · @backstage plugin-techdocs-node +1)
- [CVE-2026-106556](https://cve.now/CVE-2026-106556.md): Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization (CVSS 7.7, backstage · @backstage plugin-techdocs-node)
- [CVE-2026-106510](https://cve.now/CVE-2026-106510.md): Backstage: Remote code execution via crafted markdown\_extensions in TechDocs mkdocs.yml (CVSS 7.7, backstage · @backstage plugin-techdocs-node +1)
- [CVE-2026-77214](https://cve.now/CVE-2026-77214.md): libexpat Heap Buffer Over-read in xmlparse.c via XML\_ParseBuffer (CVSS 8.3, libexpat)
- [CVE-2026-107174](https://cve.now/CVE-2026-107174.md): Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction (CVSS 6.4, Red Hat OpenShift Serverless · Red Hat OpenShift Source-… +2)
- [CVE-2026-107169](https://cve.now/CVE-2026-107169.md): M17n-lib: null-pointer write in read\_mtext\_element() on malformed utf-8 (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2026-107167](https://cve.now/CVE-2026-107167.md): M17n-lib: heap use-after-free write in re\_init\_ic() (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2026-106064](https://cve.now/CVE-2026-106064.md): Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions (CVSS 6.3, Red Hat Enterprise Linux)
- [CVE-2026-104074](https://cve.now/CVE-2026-104074.md): Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE (CVSS 6.9, coturn)
- [CVE-2026-62179](https://cve.now/CVE-2026-62179.md): PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues (CVSS 6.5, MervinPraison praisonai-platform · praisonai-platform)
- [CVE-2026-107202](https://cve.now/CVE-2026-107202.md): CVE-2026-107202 (CVSS 9.1, jonssonyan h-ui)
- [CVE-2026-107125](https://cve.now/CVE-2026-107125.md): XnView Classic FLI File heap-based overflow (CVSS 5.3, XnView Classic)
- [CVE-2026-46438](https://cve.now/CVE-2026-46438.md): wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot\_entry (CVSS 6.5, wger-project wger · wger)
- [CVE-2026-46437](https://cve.now/CVE-2026-46437.md): wger: API credentials remain valid after logout/password change (CVSS 4.8, wger-project wger · wger)
- [CVE-2026-46434](https://cve.now/CVE-2026-46434.md): wger: Trainer Privilege Escalation - Improper Privilege Management (CVSS 7.1, wger-project wger · wger)
- [CVE-2026-107194](https://cve.now/CVE-2026-107194.md): Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login\_type":"5" in a login request, potentially (CVSS 9.2, Sungrow iSolarCloud)
- [CVE-2026-45161](https://cve.now/CVE-2026-45161.md): wger: trainer\_login accepts GET - CSRF bypass enables forced session rebinding (CVSS 5.4, wger-project wger · wger)
- [CVE-2026-107183](https://cve.now/CVE-2026-107183.md): llama.cpp before b11393 Use-After-Free via common\_chat\_peg\_mapper chat\_parser (CVSS 9.2, ggml-org llama.cpp)
- [CVE-2026-107181](https://cve.now/CVE-2026-107181.md): Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme (CVSS 8.6, Telegram Desktop)
- [CVE-2026-43976](https://cve.now/CVE-2026-43976.md): wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) (CVSS 7.1, wger-project wger · wger)
- [CVE-2026-102258](https://cve.now/CVE-2026-102258.md): Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) wh (CVSS 6.1, SonicWall SMA1000)
- [CVE-2026-102257](https://cve.now/CVE-2026-102257.md): A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the (CVSS 7.2, SonicWall SMA1000)
- [CVE-2026-102256](https://cve.now/CVE-2026-102256.md): Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi (CVSS 7.8, SonicWall SMA1000)
- [CVE-2026-102255](https://cve.now/CVE-2026-102255.md): A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. (CVSS 10.0, SonicWall SMA1000)
- [CVE-2026-98374](https://cve.now/CVE-2026-98374.md): tcp: fix use-after-free of retransmit\_skb\_hint in tcp\_send\_synack() (CVSS 8.8, Linux)
- [CVE-2026-98373](https://cve.now/CVE-2026-98373.md): mm/hugetlb: preserve mremap address delta when skipping page tables (no CVSS, Linux)
- [CVE-2026-41958](https://cve.now/CVE-2026-41958.md): A path traversal vulnerability exists in the unzip\_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). (CVSS 6.5, visidata)
- [CVE-2026-42532](https://cve.now/CVE-2026-42532.md): A path traversal vulnerability exists in the EmailSheet extract\_parts functionality of VisiData (version(s): dev (commit 38b21f78)). (CVSS 5.5, visidata)
- [CVE-2026-103435](https://cve.now/CVE-2026-103435.md): Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code (CVSS 7.7, @anthropic-ai/claude-code)
- [CVE-2026-107180](https://cve.now/CVE-2026-107180.md): MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp\_required Instances (CVSS 7.1, MISP)
- [CVE-2026-107177](https://cve.now/CVE-2026-107177.md): Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens (CVSS 7.4, ExpressGateway express-gateway)
- [CVE-2026-107162](https://cve.now/CVE-2026-107162.md): Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass (CVSS 7.6, ExpressGateway express-gateway)
- [CVE-2026-107170](https://cve.now/CVE-2026-107170.md): M17n-lib: null dereference in minput\_open\_im() after failed m17n\_init() (CVSS 2.9, Red Hat Enterprise Linux)
- [CVE-2026-107175](https://cve.now/CVE-2026-107175.md): MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes (CVSS 5.3, MISP)
- [CVE-2026-107168](https://cve.now/CVE-2026-107168.md): M17n-lib: parser infinite loop on malformed utf-8 in count\_utf\_8\_chars() (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2026-107151](https://cve.now/CVE-2026-107151.md): Rubygem-smart\_proxy\_dynflow: task update and done callbacks accept unauthenticated requests (CVSS 5.9, Red Hat Satellite)
- [CVE-2026-105140](https://cve.now/CVE-2026-105140.md): Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership (CVSS 2.3, obot-platform obot)
- [CVE-2026-105139](https://cve.now/CVE-2026-105139.md): Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources (CVSS 5.3, obot-platform obot)
- [CVE-2026-105138](https://cve.now/CVE-2026-105138.md): Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API (CVSS 7.1, obot-platform obot)
- [CVE-2026-107159](https://cve.now/CVE-2026-107159.md): MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header (CVSS 7.1, miniupnp project miniupnpd)
- [CVE-2026-106059](https://cve.now/CVE-2026-106059.md): GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript (CVSS 8.7, gitahead)
- [CVE-2026-106058](https://cve.now/CVE-2026-106058.md): GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames (CVSS 7.7, gitahead)
- [CVE-2026-106057](https://cve.now/CVE-2026-106057.md): patool before 4.0.6 OS Command Injection on Windows via shell\_quote\_nt (CVSS 8.5, wummel patool)
- [CVE-2026-106056](https://cve.now/CVE-2026-106056.md): Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting (CVSS 7.7, rundeck)
- [CVE-2026-42708](https://cve.now/CVE-2026-42708.md): WordPress WP Post Author plugin \<= 4.0.0 - SQL Injection vulnerability (CVSS 7.6, AF themes WP Post Author)
- [CVE-2026-42710](https://cve.now/CVE-2026-42710.md): WordPress Slider by 10Web plugin \<= 1.2.63 - SQL Injection vulnerability (CVSS 7.6, Slider by 10Web)
- [CVE-2026-42713](https://cve.now/CVE-2026-42713.md): WordPress Post title marquee scroll plugin \<= 9.9 - SQL Injection vulnerability (CVSS 7.6, Gopiplus Post title marquee scroll)
- [CVE-2026-42714](https://cve.now/CVE-2026-42714.md): WordPress Pix por Piggly (para Woocommerce) plugin \<= 2.1.2 - SQL Injection vulnerability (CVSS 7.6, Piggly Dev Pix por Piggly)
- [CVE-2026-92533](https://cve.now/CVE-2026-92533.md): Path Traversal in BugTracker.NET (CVSS 7.1, BugTracker.NET)
- [CVE-2026-92532](https://cve.now/CVE-2026-92532.md): Unrestricted Upload of File with Dangerous Type in BugTracker.NET (CVSS 7.5, BugTracker.NET)
- [CVE-2026-92531](https://cve.now/CVE-2026-92531.md): Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET (CVSS 7.5, BugTracker.NET)
- [CVE-2026-103668](https://cve.now/CVE-2026-103668.md): An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an (CVSS 8.6, Six Apart Movable Type Cloud Edition · Six Apart Movable Ty…)
- [CVE-2026-96408](https://cve.now/CVE-2026-96408.md): A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbit (CVSS 9.4, Six Apart Movable Type Cloud Edition · Six Apart Movable Ty…)
- [CVE-2026-42720](https://cve.now/CVE-2026-42720.md): WordPress Dynamic User Directory plugin \<= 2.4 - SQL Injection vulnerability (CVSS 7.6, Sarah Giles Dynamic User Directory)
- [CVE-2026-42721](https://cve.now/CVE-2026-42721.md): WordPress affiliate-toolkit plugin \<= 3.9.1 - SQL Injection vulnerability (CVSS 7.6, SERVIT Software Solutions affiliate-toolkit)
- [CVE-2026-105192](https://cve.now/CVE-2026-105192.md): LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization (CVSS 9.8, LMCache)
- [CVE-2026-27434](https://cve.now/CVE-2026-27434.md): WordPress WP Rentals theme \<= 3.14.2 - Broken Access Control vulnerability (CVSS 5.3, sc Internet Vivoo WP Rentals)
- [CVE-2026-104390](https://cve.now/CVE-2026-104390.md): WordPress Booktics plugin \<= 1.0.27 - Broken Access Control vulnerability (CVSS 4.3, Arraytics Booktics)
- [CVE-2026-105876](https://cve.now/CVE-2026-105876.md): WordPress Modula Image Gallery plugin \<= 3.0.11 - Sensitive Data Exposure vulnerability (CVSS 5.3, WP Chill Modula Image Gallery)
- [CVE-2026-97146](https://cve.now/CVE-2026-97146.md): Apache YuniKorn: Admission control bypass via system label forgery (CVSS 4.8, Apache Software Foundation Apache YuniKorn)
- [CVE-2026-104393](https://cve.now/CVE-2026-104393.md): WordPress Happy Addons for Elementor plugin \<= 3.50.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, weDevs Happy Addons for Elementor)
- [CVE-2026-78243](https://cve.now/CVE-2026-78243.md): Apache YuniKorn: LDAP Group provider panics on lowercase attribute name (CVSS 2.1, Apache Software Foundation Apache YuniKorn)
- [CVE-2026-105875](https://cve.now/CVE-2026-105875.md): WordPress Prime Slider – Addons For Elementor plugin \<= 4.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Prime Slider – Addons For Elementor)
- [CVE-2026-92393](https://cve.now/CVE-2026-92393.md): Apache YuniKorn: Admission control bypass via workload UPDATE operation (CVSS 2.0, Apache Software Foundation Apache YuniKorn)
- [CVE-2026-104391](https://cve.now/CVE-2026-104391.md): WordPress Quiz And Survey Master plugin \<= 11.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ExpressTech Quiz And Survey Master)
- [CVE-2026-103075](https://cve.now/CVE-2026-103075.md): WordPress Hustle plugin \<= 7.8.14.2 - Broken Access Control vulnerability (CVSS 4.3, WPMU DEV Hustle)
- [CVE-2026-105884](https://cve.now/CVE-2026-105884.md): WordPress Rocket Lazy Load plugin \<= 2.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Media Rocket Lazy Load)
- [CVE-2026-105873](https://cve.now/CVE-2026-105873.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Element Pack Elementor Addons)
- [CVE-2026-97294](https://cve.now/CVE-2026-97294.md): WordPress Media LIbrary Assistant plugin \<= 3.41 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, David Lingren Media LIbrary Assistant)
- [CVE-2026-105871](https://cve.now/CVE-2026-105871.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Element Pack Elementor Addons)
- [CVE-2026-15894](https://cve.now/CVE-2026-15894.md): Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement (CVSS 8.8, zephyrproject zephyr)
- [CVE-2026-19186](https://cve.now/CVE-2026-19186.md): Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write (CVSS 8.1, zephyrproject zephyr)
- [CVE-2026-103416](https://cve.now/CVE-2026-103416.md): Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message (CVSS 9.3, Eclipse Foundation Eclipse ThreadX - NetX Duo)
- [CVE-2025-64391](https://cve.now/CVE-2025-64391.md): This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locati (CVSS 4.1, Veeam Agent for Windows)
- [CVE-2025-64392](https://cve.now/CVE-2025-64392.md): This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a craft (CVSS 4.8, Veeam Backup Enterprise Manager)
- [CVE-2026-93026](https://cve.now/CVE-2026-93026.md): This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus upd (CVSS 6.1, Veeam Backup and Replication)
- [CVE-2026-58068](https://cve.now/CVE-2026-58068.md): This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. (CVSS 6.8, Veeam Agent for Windows)
- [CVE-2026-58069](https://cve.now/CVE-2026-58069.md): This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provide (CVSS 8.3, Veeam Backup and Replication)
- [CVE-2025-64393](https://cve.now/CVE-2025-64393.md): This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. (CVSS 9.4, Veeam Backup and Replication)
- [CVE-2026-93684](https://cve.now/CVE-2026-93684.md): Apache Impala: Stored XSS in Impala query plans (CVSS 5.4, Apache Software Foundation Apache Impala)
- [CVE-2026-90466](https://cve.now/CVE-2026-90466.md): Apache Impala: Path traversal executes JARs outside trusted paths (CVSS 6.5, Apache Software Foundation Apache Impala)
- [CVE-2026-97720](https://cve.now/CVE-2026-97720.md): Apache Impala: Impala Executor Webserver Auth Bypass (CVSS 9.1, Apache Software Foundation Apache Impala)
- [CVE-2026-5703](https://cve.now/CVE-2026-5703.md): Path Traversal in Satel Iberia SenNet Datalogger Serie 200 (CVSS 7.1, Satel Iberia SenNet Datalogger Serie)
- [CVE-2026-89417](https://cve.now/CVE-2026-89417.md): OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. \<= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed (CVSS 7.2, daanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google…)
- [CVE-2026-107104](https://cve.now/CVE-2026-107104.md): Unsafe Deserialization Vulnerability in Manacle Technologies ERP System (CVSS 9.3, Manacle Technologies Multi-tenant ERP System)
- [CVE-2026-107103](https://cve.now/CVE-2026-107103.md): SQL Injection Vulnerability in Manacle Technologies ERP System (CVSS 9.3, Manacle Technologies Multi-tenant ERP System)
- [CVE-2026-107102](https://cve.now/CVE-2026-107102.md): Account Takeover Vulnerability in Manacle Technologies ERP System (CVSS 9.3, Manacle Technologies Multi-tenant ERP System)
- [CVE-2026-102782](https://cve.now/CVE-2026-102782.md): Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership \< 7.4.0 (CVSS 9.3, ordasoft.com OrdaSoft Simple Membership extension for Joomla)
- [CVE-2026-102781](https://cve.now/CVE-2026-102781.md): Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider \< 5.4.6 (CVSS 6.9, ordasoft.com Touch Slider extension for Joomla)
- [CVE-2026-107121](https://cve.now/CVE-2026-107121.md): Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-82212](https://cve.now/CVE-2026-82212.md): Nexi XPay Build \<= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler (CVSS 7.5, Nexi XPay Build)
- [CVE-2026-82211](https://cve.now/CVE-2026-82211.md): Nexi XPay Build \<= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure (CVSS 8.2, Nexi XPay Build)
- [CVE-2026-105322](https://cve.now/CVE-2026-105322.md): Magee Shortcodes \<= 2.1.1 - Unauthenticated Mail Relay via Contact Form (CVSS 5.3, Magee Shortcodes)
- [CVE-2026-86833](https://cve.now/CVE-2026-86833.md): MetForm \< 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes (CVSS 5.4, MetForm)
- [CVE-2026-97354](https://cve.now/CVE-2026-97354.md): PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects (CVSS 4.1, PowerPress Podcasting plugin by Blubrry)
- [CVE-2026-97331](https://cve.now/CVE-2026-97331.md): User Private Files \< 2.1.9 - Subscriber+ User Email Address Disclosure via dpk\_upvf\_rmv\_access (CVSS 4.3, User Private Files)
- [CVE-2026-97188](https://cve.now/CVE-2026-97188.md): String Locator \< 2.6.8 - Unauthenticated PHP Object Injection via Database Editor (CVSS 8.8, String locator)
- [CVE-2026-96530](https://cve.now/CVE-2026-96530.md): Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget (CVSS 6.5, Optimole)
- [CVE-2026-87971](https://cve.now/CVE-2026-87971.md): If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter (CVSS 7.1, If-So Dynamic Content)
- [CVE-2026-87782](https://cve.now/CVE-2026-87782.md): Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator (CVSS 8.8, Koinonia Link)
- [CVE-2026-86816](https://cve.now/CVE-2026-86816.md): WPCafe \< 3.0.21 - Unauthenticated Product Data Disclosure via REST API (CVSS 5.3, WPCafe)
- [CVE-2026-105316](https://cve.now/CVE-2026-105316.md): Magee Shortcodes \<= 2.1.1 - Reflected XSS via live\_preview and magee\_create\_shortcode Actions (CVSS 7.1, Magee Shortcodes)
- [CVE-2026-104953](https://cve.now/CVE-2026-104953.md): MPG \< 4.2.3 - Editor+ SQLi via Project Import (CVSS 6.8, MPG)
- [CVE-2026-104678](https://cve.now/CVE-2026-104678.md): CP Media Player \< 1.3.4 - Contributor+ Media Player Settings Update (CVSS 2.7, CP Media Player)
- [CVE-2026-104677](https://cve.now/CVE-2026-104677.md): WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP (CVSS 7.2, WP Coder)
- [CVE-2026-104667](https://cve.now/CVE-2026-104667.md): Animated Number Counters \< 3.1 - Editor+ Second-Order SQLi via Counter Order (CVSS 6.8, Animated Number Counters)
- [CVE-2026-104653](https://cve.now/CVE-2026-104653.md): Envira Gallery \< 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions (CVSS 6.8, Envira Gallery)
- [CVE-2026-104652](https://cve.now/CVE-2026-104652.md): Envira Gallery \< 1.16.1 - Author+ Stored XSS via Gallery Image ID (CVSS 6.8, Envira Gallery)
- [CVE-2026-104651](https://cve.now/CVE-2026-104651.md): Yaad Sarig Payment Gateway For WC \< 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR (CVSS 4.3, Yaad Sarig Payment Gateway For WC)
- [CVE-2026-104050](https://cve.now/CVE-2026-104050.md): Academy LMS \< 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render\_quiz\_answers (CVSS 4.3, Academy LMS)
- [CVE-2026-104049](https://cve.now/CVE-2026-104049.md): Academy LMS \< 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint (CVSS 4.3, Academy LMS)
- [CVE-2026-103681](https://cve.now/CVE-2026-103681.md): Frontend Dashboard \< 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed\_user\_profile\_delete (CVSS 4.3, Frontend Dashboard)
- [CVE-2026-103378](https://cve.now/CVE-2026-103378.md): Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File (CVSS 6.5, Geliver Akıllı Kargo Pazaryeri)
- [CVE-2026-103323](https://cve.now/CVE-2026-103323.md): Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure (CVSS 5.9, Integration for Epos Now and WooCommerce)
- [CVE-2026-103870](https://cve.now/CVE-2026-103870.md): Pulp-rpm: distribution tree publish creates directories from .treeinfo ids (CVSS 5.0, Red Hat Satellite · Red Hat Update Infrastructure 4 for… +1)
- [CVE-2026-103869](https://cve.now/CVE-2026-103869.md): Pulp-ansible: bearer tokens are reused across remotes in a worker (CVSS 6.5, Red Hat Ansible Automation Platform · Red Hat Satellite)
- [CVE-2026-103868](https://cve.now/CVE-2026-103868.md): Pulp-container: registry credentials are reused across remotes in a worker (CVSS 6.5, Red Hat Ansible Automation Platform · Red Hat Satellite +2)
- [CVE-2026-59347](https://cve.now/CVE-2026-59347.md): VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability (CVSS 8.1, VMware Workstation · VMware Fusion)
- [CVE-2026-59346](https://cve.now/CVE-2026-59346.md): VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability (CVSS 9.3, VMware Workstation · VMware Fusion)
- [CVE-2026-102173](https://cve.now/CVE-2026-102173.md): Kirki – Freeform Page Builder, Website Builder & Customizer \<= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata (CVSS 7.2, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-19572](https://cve.now/CVE-2026-19572.md): FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability (CVSS 9.3, Flexera FlexNet Publisher)
- [CVE-2026-84897](https://cve.now/CVE-2026-84897.md): wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion (CVSS 6.9, wolfSSL wolfSSH)
- [CVE-2026-83742](https://cve.now/CVE-2026-83742.md): wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms (CVSS 5.3, wolfSSL wolfSSH)
- [CVE-2026-83540](https://cve.now/CVE-2026-83540.md): wolfSSHd on Windows race condition leading to logon token reused across connections (CVSS 7.7, wolfSSL wolfSSH)
- [CVE-2026-81535](https://cve.now/CVE-2026-81535.md): wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check (CVSS 6.3, wolfSSL wolfSSH)
- [CVE-2026-16516](https://cve.now/CVE-2026-16516.md): wolfSSH ECDSA host key curve not validated against negotiated algorithm (CVSS 9.0, wolfSSL wolfSSH)
- [CVE-2026-106061](https://cve.now/CVE-2026-106061.md): Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-14911](https://cve.now/CVE-2026-14911.md): Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read (CVSS 9.3, ASUS Router)
- [CVE-2026-19396](https://cve.now/CVE-2026-19396.md): A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an u (CVSS 7.7, ASUS Router)
- [CVE-2026-19386](https://cve.now/CVE-2026-19386.md): A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configu (CVSS 9.3, ASUS Router)
- [CVE-2026-16528](https://cve.now/CVE-2026-16528.md): Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credent (CVSS 8.4, ASUS Router)
- [CVE-2026-106471](https://cve.now/CVE-2026-106471.md): Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching (CVSS 8.1, Red Hat Satellite)
- [CVE-2026-102478](https://cve.now/CVE-2026-102478.md): In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access (CVSS 8.7, Octopus Deploy Octopus Server)
- [CVE-2026-105324](https://cve.now/CVE-2026-105324.md): An HTTP header injection vulnerability was found in the ADM (CVSS 9.2, ASUSTOR ADM)
- [CVE-2026-88962](https://cve.now/CVE-2026-88962.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-93443](https://cve.now/CVE-2026-93443.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-93448](https://cve.now/CVE-2026-93448.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-93449](https://cve.now/CVE-2026-93449.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-93445](https://cve.now/CVE-2026-93445.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-93447](https://cve.now/CVE-2026-93447.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-93675](https://cve.now/CVE-2026-93675.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-93677](https://cve.now/CVE-2026-93677.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 7.7, IBM Langflow OSS)
- [CVE-2026-93678](https://cve.now/CVE-2026-93678.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 7.6, IBM Langflow OSS)
- [CVE-2026-93679](https://cve.now/CVE-2026-93679.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 4.3, IBM Langflow OSS)
- [CVE-2026-93674](https://cve.now/CVE-2026-93674.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-97671](https://cve.now/CVE-2026-97671.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-97673](https://cve.now/CVE-2026-97673.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 8.8, IBM Langflow OSS)
- [CVE-2025-70515](https://cve.now/CVE-2025-70515.md): The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. (CVSS 6.1)
- [CVE-2025-70516](https://cve.now/CVE-2025-70516.md): The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless user (CVSS 9.1)
- [CVE-2025-70517](https://cve.now/CVE-2025-70517.md): The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing r (CVSS 8.8)
- [CVE-2025-70518](https://cve.now/CVE-2025-70518.md): The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. (CVSS 10.0)
- [CVE-2025-70519](https://cve.now/CVE-2025-70519.md): The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. (CVSS 6.1)
- [CVE-2025-70520](https://cve.now/CVE-2025-70520.md): The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless user (CVSS 9.8)
- [CVE-2025-70521](https://cve.now/CVE-2025-70521.md): The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. (CVSS 9.8)
- [CVE-2025-70522](https://cve.now/CVE-2025-70522.md): The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing r (CVSS 8.8)
- [CVE-2026-42616](https://cve.now/CVE-2026-42616.md): In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfsca (CVSS 7.8)
- [CVE-2026-42617](https://cve.now/CVE-2026-42617.md): In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs\_ir\_to\_ib() in index.c that allows an attacker to corrupt heap memory in th (CVSS 7.1)
- [CVE-2026-42618](https://cve.now/CVE-2026-42618.md): In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs\_decompress() in compress.c that allows an attacker to corrupt one byte of (CVSS 7.1)
- [CVE-2026-46569](https://cve.now/CVE-2026-46569.md): In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs\_ib\_copy\_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt (CVSS 7.7)
- [CVE-2026-46570](https://cve.now/CVE-2026-46570.md): In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs\_index\_walk\_down() in libntfs-3g/index.c that allows an attacker to corrupt (CVSS 8.1)
- [CVE-2026-46571](https://cve.now/CVE-2026-46571.md): In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs\_fix\_file\_name() in libntfs-3g/reparse.c that allows an attacker to read poss (CVSS 5.5)
- [CVE-2026-46572](https://cve.now/CVE-2026-46572.md): In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs\_ib\_cut\_tail() in libntfs-3g/index.c that allows an attacker to corrupt hea (CVSS 7.4)
- [CVE-2026-88514](https://cve.now/CVE-2026-88514.md): An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.