# CVEs published 2026-10-12

683 CVEs were published on October 12, 2026: 54 critical, 261 high. Days are UTC.

- [CVE-2026-108941](https://cve.now/CVE-2026-108941.md): Linketic CityGaussian Sidecar Parsing common.py parse\_cfg\_args code injection (CVSS 2.4, Linketic CityGaussian)
- [CVE-2026-108940](https://cve.now/CVE-2026-108940.md): EricLBuehler Mistral.rs handlers.rs calibration\_apply path traversal (CVSS 6.9, EricLBuehler Mistral.rs)
- [CVE-2026-17484](https://cve.now/CVE-2026-17484.md): IBM i is Information Disclosure (CVSS 5.3, IBM i)
- [CVE-2026-17487](https://cve.now/CVE-2026-17487.md): IBM i is Information Disclosure (CVSS 5.3, IBM i)
- [CVE-2026-18318](https://cve.now/CVE-2026-18318.md): IBM i Information Disclosure (CVSS 5.3, IBM i)
- [CVE-2026-18343](https://cve.now/CVE-2026-18343.md): IBM i is Affected By An Improper Privilege Management Vulnerability (CVSS 4.4, IBM i)
- [CVE-2026-81858](https://cve.now/CVE-2026-81858.md): IBM i is Affected By A Denial of Service Vulnerability in Host Servers (CVSS 5.4, IBM i)
- [CVE-2026-93886](https://cve.now/CVE-2026-93886.md): IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI (CVSS 8.3, IBM i)
- [CVE-2026-96119](https://cve.now/CVE-2026-96119.md): IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI (CVSS 9.9, IBM i)
- [CVE-2026-19938](https://cve.now/CVE-2026-19938.md): Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-19937](https://cve.now/CVE-2026-19937.md): Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses (CVSS 5.7, zephyrproject zephyr)
- [CVE-2026-19936](https://cve.now/CVE-2026-19936.md): Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference (CVSS 4.8, zephyrproject zephyr)
- [CVE-2026-108939](https://cve.now/CVE-2026-108939.md): EricLBuehler mistral.rs media\_source.rs is\_global\_ip server-side request forgery (CVSS 6.9, EricLBuehler mistral.rs)
- [CVE-2026-108938](https://cve.now/CVE-2026-108938.md): code-projects Matrimonial System matrimony.sql file access (CVSS 6.9, code-projects Matrimonial System)
- [CVE-2026-75076](https://cve.now/CVE-2026-75076.md): IBM Aspera Enterprise Webapps Information Disclosure (CVSS 4.3, IBM Aspera Enterprise WebApps)
- [CVE-2026-75095](https://cve.now/CVE-2026-75095.md): IBM Aspera Enterprise Webapps Denial of Service (CVSS 7.5, IBM Aspera Enterprise WebApps)
- [CVE-2026-75621](https://cve.now/CVE-2026-75621.md): IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges (CVSS 6.2, IBM Aspera Enterprise WebApps)
- [CVE-2026-75782](https://cve.now/CVE-2026-75782.md): IBM Aspera Enterprise Webapps Untrusted Search Path (CVSS 7.8, IBM Aspera Enterprise WebApps)
- [CVE-2026-92832](https://cve.now/CVE-2026-92832.md): IBM Aspera Enterprise Webapps Information Disclosure (CVSS 5.1, IBM Aspera Enterprise WebApps)
- [CVE-2026-93891](https://cve.now/CVE-2026-93891.md): Security Vulnerability identified in IBM TRIRIGA - XXE (CVSS 7.6, IBM TRIRIGA Application Platform)
- [CVE-2026-93892](https://cve.now/CVE-2026-93892.md): Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console (CVSS 8.1, IBM TRIRIGA Application Platform)
- [CVE-2026-102627](https://cve.now/CVE-2026-102627.md): Security Vulnerability identified in IBM TRIRIGA - Zip Slip (CVSS 8.8, IBM TRIRIGA Application Platform)
- [CVE-2026-108937](https://cve.now/CVE-2026-108937.md): code-projects Online Ticket Reservation System medallion.sql file information disclosure (CVSS 6.9, code-projects Online Ticket Reservation System)
- [CVE-2026-17475](https://cve.now/CVE-2026-17475.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 7.1, IBM Planning Analytics)
- [CVE-2026-18541](https://cve.now/CVE-2026-18541.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 6.4, IBM Planning Analytics)
- [CVE-2026-19620](https://cve.now/CVE-2026-19620.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 8.8, IBM Planning Analytics)
- [CVE-2026-19622](https://cve.now/CVE-2026-19622.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 8.8, IBM Planning Analytics)
- [CVE-2026-75063](https://cve.now/CVE-2026-75063.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 5.4, IBM Planning Analytics)
- [CVE-2026-75061](https://cve.now/CVE-2026-75061.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 7.5, IBM Planning Analytics)
- [CVE-2026-19627](https://cve.now/CVE-2026-19627.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 8.2, IBM Planning Analytics)
- [CVE-2026-85457](https://cve.now/CVE-2026-85457.md): IBM Planning Analytics Local is affected by security vulnerabilities (CVSS 8.1, IBM Planning Analytics)
- [CVE-2026-108936](https://cve.now/CVE-2026-108936.md): Edimax BR-6208AC QoS Page formQoS cross site scripting (CVSS 4.8, Edimax BR-6208AC)
- [CVE-2026-82101](https://cve.now/CVE-2026-82101.md): DataStage on Cloud Pak for Data Path Traversal (CVSS 9.6, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82103](https://cve.now/CVE-2026-82103.md): DataStage on Cloud Pak for Data Information Disclosure (CVSS 9.6, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82110](https://cve.now/CVE-2026-82110.md): DataStage on Cloud Pak for Data Path Traversal (CVSS 9.6, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82096](https://cve.now/CVE-2026-82096.md): DataStage on Cloud Pak for Data Command Injection (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82108](https://cve.now/CVE-2026-82108.md): DataStage on Cloud Pak for Data Code Injection (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-84418](https://cve.now/CVE-2026-84418.md): DataStage on Cloud Pak for Data Improper Certificate Validation (CVSS 7.4, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-109675](https://cve.now/CVE-2026-109675.md): Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs (CVSS 5.3, frappe suite)
- [CVE-2026-109674](https://cve.now/CVE-2026-109674.md): Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-109673](https://cve.now/CVE-2026-109673.md): Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names (CVSS 8.5, frappe erpnext)
- [CVE-2026-109672](https://cve.now/CVE-2026-109672.md): Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109671](https://cve.now/CVE-2026-109671.md): Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages (CVSS 8.5, frappe erpnext)
- [CVE-2026-109670](https://cve.now/CVE-2026-109670.md): Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name (CVSS 5.1, frappe erpnext)
- [CVE-2026-109669](https://cve.now/CVE-2026-109669.md): Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification (CVSS 5.3, frappe erpnext)
- [CVE-2026-109668](https://cve.now/CVE-2026-109668.md): Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints (CVSS 5.3, frappe erpnext)
- [CVE-2026-109667](https://cve.now/CVE-2026-109667.md): Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation (CVSS 8.7, frappe erpnext)
- [CVE-2026-109666](https://cve.now/CVE-2026-109666.md): Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109665](https://cve.now/CVE-2026-109665.md): Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation (CVSS 5.3, frappe erpnext)
- [CVE-2026-109664](https://cve.now/CVE-2026-109664.md): Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification (CVSS 5.3, frappe erpnext)
- [CVE-2026-109663](https://cve.now/CVE-2026-109663.md): Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters (CVSS 7.1, frappe erpnext)
- [CVE-2026-109662](https://cve.now/CVE-2026-109662.md): Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form (CVSS 5.3, frappe erpnext)
- [CVE-2026-109661](https://cve.now/CVE-2026-109661.md): Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109660](https://cve.now/CVE-2026-109660.md): Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109659](https://cve.now/CVE-2026-109659.md): Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109658](https://cve.now/CVE-2026-109658.md): Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109657](https://cve.now/CVE-2026-109657.md): Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name (CVSS 5.1, frappe erpnext)
- [CVE-2026-109656](https://cve.now/CVE-2026-109656.md): Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access (CVSS 7.1, frappe erpnext)
- [CVE-2026-109655](https://cve.now/CVE-2026-109655.md): Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109654](https://cve.now/CVE-2026-109654.md): Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints (CVSS 5.3, frappe erpnext)
- [CVE-2026-109653](https://cve.now/CVE-2026-109653.md): Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover (CVSS 8.5, frappe erpnext)
- [CVE-2026-109652](https://cve.now/CVE-2026-109652.md): Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields (CVSS 8.7, frappe erpnext)
- [CVE-2026-109651](https://cve.now/CVE-2026-109651.md): Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field (CVSS 5.3, frappe erpnext)
- [CVE-2026-109650](https://cve.now/CVE-2026-109650.md): Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109649](https://cve.now/CVE-2026-109649.md): Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests (CVSS 7.1, frappe erpnext)
- [CVE-2026-109648](https://cve.now/CVE-2026-109648.md): Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-109647](https://cve.now/CVE-2026-109647.md): Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-109646](https://cve.now/CVE-2026-109646.md): Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-109645](https://cve.now/CVE-2026-109645.md): Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization (CVSS 7.1, frappe erpnext)
- [CVE-2026-109644](https://cve.now/CVE-2026-109644.md): Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109643](https://cve.now/CVE-2026-109643.md): Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109642](https://cve.now/CVE-2026-109642.md): Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints (CVSS 5.3, frappe erpnext)
- [CVE-2026-109641](https://cve.now/CVE-2026-109641.md): Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints (CVSS 6.9, frappe erpnext)
- [CVE-2026-109640](https://cve.now/CVE-2026-109640.md): Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification (CVSS 7.2, frappe erpnext)
- [CVE-2026-109639](https://cve.now/CVE-2026-109639.md): Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests (CVSS 7.1, frappe erpnext)
- [CVE-2026-109638](https://cve.now/CVE-2026-109638.md): Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-109637](https://cve.now/CVE-2026-109637.md): Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification (CVSS 7.1, frappe erpnext)
- [CVE-2026-109636](https://cve.now/CVE-2026-109636.md): Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109635](https://cve.now/CVE-2026-109635.md): Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints (CVSS 5.3, frappe erpnext)
- [CVE-2026-109634](https://cve.now/CVE-2026-109634.md): Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints (CVSS 6.9, frappe erpnext)
- [CVE-2026-109633](https://cve.now/CVE-2026-109633.md): Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page (CVSS 8.6, frappe erpnext)
- [CVE-2026-109632](https://cve.now/CVE-2026-109632.md): Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109631](https://cve.now/CVE-2026-109631.md): Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-109630](https://cve.now/CVE-2026-109630.md): Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints (CVSS 5.3, frappe erpnext)
- [CVE-2026-109629](https://cve.now/CVE-2026-109629.md): Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint (CVSS 5.3, frappe erpnext)
- [CVE-2026-109628](https://cve.now/CVE-2026-109628.md): Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization (CVSS 7.1, frappe erpnext)
- [CVE-2026-109627](https://cve.now/CVE-2026-109627.md): Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109626](https://cve.now/CVE-2026-109626.md): Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109625](https://cve.now/CVE-2026-109625.md): Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109624](https://cve.now/CVE-2026-109624.md): Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109623](https://cve.now/CVE-2026-109623.md): Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization (CVSS 5.3, frappe erpnext)
- [CVE-2026-109622](https://cve.now/CVE-2026-109622.md): Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization (CVSS 5.3, frappe erpnext)
- [CVE-2026-109621](https://cve.now/CVE-2026-109621.md): Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass (CVSS 7.1, frappe erpnext)
- [CVE-2026-109617](https://cve.now/CVE-2026-109617.md): Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109616](https://cve.now/CVE-2026-109616.md): Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification (CVSS 7.1, frappe erpnext)
- [CVE-2026-109615](https://cve.now/CVE-2026-109615.md): Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-109614](https://cve.now/CVE-2026-109614.md): Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data (CVSS 7.1, frappe erpnext)
- [CVE-2026-109613](https://cve.now/CVE-2026-109613.md): Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification (CVSS 7.1, frappe erpnext)
- [CVE-2026-109612](https://cve.now/CVE-2026-109612.md): Frappe ERPNext before 15.120.0 Stored XSS via Report View (CVSS 8.5, frappe erpnext)
- [CVE-2026-109611](https://cve.now/CVE-2026-109611.md): Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints (CVSS 5.3, frappe erpnext)
- [CVE-2026-109610](https://cve.now/CVE-2026-109610.md): Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification (CVSS 7.1, frappe erpnext)
- [CVE-2026-109609](https://cve.now/CVE-2026-109609.md): Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-109608](https://cve.now/CVE-2026-109608.md): Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input (CVSS 8.7, frappe erpnext)
- [CVE-2026-109604](https://cve.now/CVE-2026-109604.md): ERPNext before 15.112.0 Stored XSS via Tool View Record Names (CVSS 8.5, frappe erpnext)
- [CVE-2026-109603](https://cve.now/CVE-2026-109603.md): Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit (CVSS 4.8, frappe)
- [CVE-2026-109602](https://cve.now/CVE-2026-109602.md): Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters (CVSS 5.1, frappe)
- [CVE-2026-109601](https://cve.now/CVE-2026-109601.md): Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML (CVSS 7.1, frappe)
- [CVE-2026-109600](https://cve.now/CVE-2026-109600.md): Frappe before 16.31.0 Improper Access Control in Document Follow Notifications (CVSS 6.9, frappe)
- [CVE-2026-109599](https://cve.now/CVE-2026-109599.md): Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification (CVSS 5.3, frappe)
- [CVE-2026-109598](https://cve.now/CVE-2026-109598.md): Frappe before 16.33.0 Broken Authorization via send\_sms Endpoint (CVSS 5.3, frappe)
- [CVE-2026-109597](https://cve.now/CVE-2026-109597.md): Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs (CVSS 5.1, gohugoio hugo)
- [CVE-2026-109596](https://cve.now/CVE-2026-109596.md): Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor (CVSS 6.7, gohugoio hugo)
- [CVE-2026-109595](https://cve.now/CVE-2026-109595.md): Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver (CVSS 6.7, gohugoio hugo)
- [CVE-2026-109574](https://cve.now/CVE-2026-109574.md): Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback (CVSS 6.7, gohugoio hugo)
- [CVE-2026-109573](https://cve.now/CVE-2026-109573.md): phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint (CVSS 9.2, thorsten phpMyFAQ)
- [CVE-2026-109572](https://cve.now/CVE-2026-109572.md): Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy (CVSS 7.2, open-webui)
- [CVE-2025-71432](https://cve.now/CVE-2025-71432.md): Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover (CVSS 8.6, frappe erpnext)
- [CVE-2025-71431](https://cve.now/CVE-2025-71431.md): Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters (CVSS 6.3, frappe)
- [CVE-2025-71430](https://cve.now/CVE-2025-71430.md): Frappe before 15.91.1 Stored XSS via Leaderboard User Names (CVSS 5.1, frappe)
- [CVE-2024-58391](https://cve.now/CVE-2024-58391.md): Frappe before 15.4.0 XSS via Printview Parameters (CVSS 5.3, frappe)
- [CVE-2024-58390](https://cve.now/CVE-2024-58390.md): Frappe before 15.41.0 Privilege Escalation via Document Action (CVSS 8.7, frappe)
- [CVE-2023-54412](https://cve.now/CVE-2023-54412.md): Frappe before 13.46.3 Improper Access Control for Email Templates (CVSS 7.1, frappe)
- [CVE-2023-54411](https://cve.now/CVE-2023-54411.md): Frappe before 13.32.0 Weak Authentication via Print View Key (CVSS 8.2, frappe)
- [CVE-2023-54410](https://cve.now/CVE-2023-54410.md): Frappe before 13.22.0 Improper Authorization via Document Rename (CVSS 5.3, frappe)
- [CVE-2023-54409](https://cve.now/CVE-2023-54409.md): Frappe before 13.46.1 XSS via html2text Weak Sanitization (CVSS 5.9, frappe)
- [CVE-2023-54408](https://cve.now/CVE-2023-54408.md): Frappe before 14.31.0 HTML Injection via Weak Escaping (CVSS 5.1, frappe)
- [CVE-2023-54407](https://cve.now/CVE-2023-54407.md): Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks (CVSS 6.9, frappe)
- [CVE-2023-54406](https://cve.now/CVE-2023-54406.md): Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts (CVSS 6.9, frappe)
- [CVE-2026-108935](https://cve.now/CVE-2026-108935.md): Edimax BR-6208AC Port Forwarding formPortFw cross site scripting (CVSS 4.8, Edimax BR-6208AC)
- [CVE-2026-108934](https://cve.now/CVE-2026-108934.md): Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting (CVSS 4.8, Edimax BR-6208AC)
- [CVE-2026-102596](https://cve.now/CVE-2026-102596.md): Nango: Production flow RBAC bypass on private flow-read routes (CVSS 4.3, NangoHQ nango)
- [CVE-2026-44828](https://cve.now/CVE-2026-44828.md): Qexo initialization endpoint can reset setup state and expose stored credentials (CVSS 9.3, Qexo)
- [CVE-2026-54459](https://cve.now/CVE-2026-54459.md): FileRise: Missing CSRF enforcement for file creation and share-link creation (CVSS 4.3, error311 FileRise)
- [CVE-2026-104140](https://cve.now/CVE-2026-104140.md): QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values (CVSS 6.1, QGIS)
- [CVE-2026-108933](https://cve.now/CVE-2026-108933.md): Edimax BR-6208AC formFilter cross site scripting (CVSS 4.8, Edimax BR-6208AC)
- [CVE-2026-90911](https://cve.now/CVE-2026-90911.md): Maximo AI Service Denial of Service (CVSS 7.5, IBM Maximo AI Service)
- [CVE-2026-90912](https://cve.now/CVE-2026-90912.md): Maximo AI Service Denial of Service (CVSS 7.5, IBM Maximo AI Service)
- [CVE-2026-90920](https://cve.now/CVE-2026-90920.md): Maximo AI Service Code Injection (CVSS 9.8, IBM Maximo AI Service)
- [CVE-2026-90921](https://cve.now/CVE-2026-90921.md): Maximo AI Service Denial of Service (CVSS 7.5, IBM Maximo AI Service)
- [CVE-2026-92876](https://cve.now/CVE-2026-92876.md): IBM Maximo Application Suite - IoT Component Denial of Service (CVSS 7.5, IBM Maximo Application Suite - IoT Component)
- [CVE-2026-49484](https://cve.now/CVE-2026-49484.md): Code for IBM i: Temporary files are visible to all users (CVSS 5.1, codefori vscode-ibmi)
- [CVE-2026-49483](https://cve.now/CVE-2026-49483.md): Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution (CVSS 8.9, codefori vscode-ibmi)
- [CVE-2026-53922](https://cve.now/CVE-2026-53922.md): odhcpd: pre-auth remote DoS via size\_t underflow in dhcpv6\_ia\_handle\_IAs (stack BOF, canary-terminated) (CVSS 6.5, openwrt odhcpd · openwrt)
- [CVE-2026-108932](https://cve.now/CVE-2026-108932.md): Netcore NR268 DHCP Hostname filter\_hosts\_dump.cgi eval cross site scripting (CVSS 5.3, Netcore NR268)
- [CVE-2026-41210](https://cve.now/CVE-2026-41210.md): Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq\_parameter\_set\_id (CVSS 6.5, moonlight-stream moonlight-qt)
- [CVE-2026-103658](https://cve.now/CVE-2026-103658.md): GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionar (CVSS 5.9, GNU Aspell)
- [CVE-2026-102539](https://cve.now/CVE-2026-102539.md): Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set (CVSS 5.7, super-productivity)
- [CVE-2026-84312](https://cve.now/CVE-2026-84312.md): Nginx UI: Casdoor SSO callback uses a constant \`state\` parameter (login CSRF) (CVSS 7.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84360](https://cve.now/CVE-2026-84360.md): Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools (CVSS 8.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84316](https://cve.now/CVE-2026-84316.md): Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-84319](https://cve.now/CVE-2026-84319.md): Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context (CVSS 8.3, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-18513](https://cve.now/CVE-2026-18513.md): IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management (CVSS 7.2, IBM Maximo Application Suite - Location Service for Esri Co…)
- [CVE-2026-18517](https://cve.now/CVE-2026-18517.md): IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control (CVSS 7.7, IBM Maximo Application Suite - Location Service for Esri Co…)
- [CVE-2026-18529](https://cve.now/CVE-2026-18529.md): IBM Maximo Application Suite - Location Service for Esri Component Code Execution (CVSS 8.7, IBM Maximo Application Suite - Location Service for Esri Co…)
- [CVE-2026-18533](https://cve.now/CVE-2026-18533.md): IBM Maximo Application Suite - Location Service for Esri Component Code Execution (CVSS 6.5, IBM Maximo Application Suite - Location Service for Esri Co…)
- [CVE-2026-18537](https://cve.now/CVE-2026-18537.md): IBM Maximo Application Suite - Location Service for Esri Component Code Execution (CVSS 8.7, IBM Maximo Application Suite - Location Service for Esri Co…)
- [CVE-2026-75881](https://cve.now/CVE-2026-75881.md): IBM Maximo Application Suite - IoT Component Denial of Service (CVSS 7.5, IBM Maximo Application Suite - IoT Component)
- [CVE-2026-78673](https://cve.now/CVE-2026-78673.md): Maximo AI Service Improper Input Validation (CVSS 7.5, IBM Maximo AI Service)
- [CVE-2026-105052](https://cve.now/CVE-2026-105052.md): IBM Maximo Application Suite Information Disclosure (CVSS 7.5, IBM Maximo Application Suite)
- [CVE-2026-108931](https://cve.now/CVE-2026-108931.md): Netcore NR268 DHCP dhcp\_dynamicip\_show.cgi eval cross site scripting (CVSS 5.3, Netcore NR268)
- [CVE-2026-84317](https://cve.now/CVE-2026-84317.md): Nginx UI: MCP nginx\_config\_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-109571](https://cve.now/CVE-2026-109571.md): Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE (CVSS 2.3, Fire-Boltt BSW013)
- [CVE-2026-109570](https://cve.now/CVE-2026-109570.md): Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection (CVSS 5.3, Fire-Boltt BSW013)
- [CVE-2026-109569](https://cve.now/CVE-2026-109569.md): sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace (CVSS 9.3, Th0rgal sandboxed.sh)
- [CVE-2026-109568](https://cve.now/CVE-2026-109568.md): Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes (CVSS 7.1, MarceauKa Shaark)
- [CVE-2026-109567](https://cve.now/CVE-2026-109567.md): Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component (CVSS 8.6, zofe rapyd-admin)
- [CVE-2026-109566](https://cve.now/CVE-2026-109566.md): Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder (CVSS 9.3, zofe rapyd-admin)
- [CVE-2026-109565](https://cve.now/CVE-2026-109565.md): Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component (CVSS 5.3, zofe rapyd-admin)
- [CVE-2026-109564](https://cve.now/CVE-2026-109564.md): LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint (CVSS 2.3, LearnHouse)
- [CVE-2026-109563](https://cve.now/CVE-2026-109563.md): N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex (CVSS 8.7, rdfjs N3.js)
- [CVE-2026-109562](https://cve.now/CVE-2026-109562.md): SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API (CVSS 5.3, snapotter-hq SnapOtter)
- [CVE-2026-109561](https://cve.now/CVE-2026-109561.md): goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations (CVSS 2.3, aaif-goose goose)
- [CVE-2026-109560](https://cve.now/CVE-2026-109560.md): Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining (CVSS 7.7, continuedev continue)
- [CVE-2026-109559](https://cve.now/CVE-2026-109559.md): EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate (CVSS 8.4, tianma-if EdgeEver)
- [CVE-2026-109558](https://cve.now/CVE-2026-109558.md): EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview (CVSS 8.5, tianma-if EdgeEver)
- [CVE-2026-109557](https://cve.now/CVE-2026-109557.md): EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview (CVSS 8.4, tianma-if EdgeEver)
- [CVE-2026-109556](https://cve.now/CVE-2026-109556.md): EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC (CVSS 7.3, tianma-if EdgeEver)
- [CVE-2026-109380](https://cve.now/CVE-2026-109380.md): modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field (CVSS 8.7, ayuhito modern-tar)
- [CVE-2026-109379](https://cve.now/CVE-2026-109379.md): Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check (CVSS 6.9, cockpit-hq cockpit)
- [CVE-2026-109378](https://cve.now/CVE-2026-109378.md): SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer\_url (CVSS 5.3, SPIP)
- [CVE-2026-109377](https://cve.now/CVE-2026-109377.md): ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods (CVSS 5.3, Frappe ERPNext)
- [CVE-2026-109376](https://cve.now/CVE-2026-109376.md): ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get\_timesheet\_html (CVSS 5.3, Frappe ERPNext)
- [CVE-2026-109375](https://cve.now/CVE-2026-109375.md): Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction (CVSS 4.9, Vercel deepsec)
- [CVE-2025-71429](https://cve.now/CVE-2025-71429.md): GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py (CVSS 9.3, RVC-Boss GPT-SoVITS)
- [CVE-2024-58389](https://cve.now/CVE-2024-58389.md): HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter (CVSS 5.1, HoloViz Panel)
- [CVE-2022-51020](https://cve.now/CVE-2022-51020.md): Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints (CVSS 6.0, mher flower)
- [CVE-2021-48012](https://cve.now/CVE-2021-48012.md): fast-toml through 0.5.4 Prototype Pollution via \_\_proto\_\_ Keys in Parsed TOML (CVSS 8.8, Gin-Quin fast-toml)
- [CVE-2021-48011](https://cve.now/CVE-2021-48011.md): Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments (CVSS 8.7, lukejacksonn servor)
- [CVE-2020-37280](https://cve.now/CVE-2020-37280.md): cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths (CVSS 8.7, PelionIoT cbor-sync)
- [CVE-2020-37279](https://cve.now/CVE-2020-37279.md): easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function (CVSS 9.2, karuppiah7890 easy-pdf-merge)
- [CVE-2026-16678](https://cve.now/CVE-2026-16678.md): IBM Power Systems Firmware Denial of Service (CVSS 4.5, IBM Virtualization Management Interface)
- [CVE-2026-96261](https://cve.now/CVE-2026-96261.md): IBM Power Systems Firmware Buffer Overflow (CVSS 7.3, IBM PowerVM Hypervisor)
- [CVE-2026-96262](https://cve.now/CVE-2026-96262.md): IBM Power Systems Firmware Buffer Overflow (CVSS 8.2, IBM PowerVM Hypervisor)
- [CVE-2026-96263](https://cve.now/CVE-2026-96263.md): IBM Power Systems Firmware Buffer Overflow (CVSS 8.2, IBM PowerVM Hypervisor)
- [CVE-2026-96264](https://cve.now/CVE-2026-96264.md): IBM Power Systems Firmware Buffer Overflow (CVSS 8.2, IBM PowerVM Hypervisor)
- [CVE-2026-96265](https://cve.now/CVE-2026-96265.md): IBM Power Systems Firmware Improper Memory Buffer Restriction (CVSS 8.2, IBM PowerVM Hypervisor)
- [CVE-2026-96266](https://cve.now/CVE-2026-96266.md): IBM Power Systems Firmware Buffer Overflow (CVSS 8.2, IBM PowerVM Hypervisor)
- [CVE-2026-84313](https://cve.now/CVE-2026-84313.md): Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover (CVSS 8.8, 0xJacky nginx-ui · Nginx-UI +1)
- [CVE-2026-84321](https://cve.now/CVE-2026-84321.md): Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable (CVSS 5.4, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-53997](https://cve.now/CVE-2026-53997.md): Netherman Portal del Hermano Account Takeover via Password Reset Oracle (CVSS 9.1, NetHerman Portal del Hermano)
- [CVE-2026-84314](https://cve.now/CVE-2026-84314.md): Nginx UI: Account Takeover via Missing \`RequireSecureSession\` on User Management Endpoint (CVSS 8.7, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-108930](https://cve.now/CVE-2026-108930.md): Netcore NR268 DDNS ddns\_wan\_list\_show.cgi ddns\_wan\_list\_show information disclosure (CVSS 5.1, Netcore NR268)
- [CVE-2026-84320](https://cve.now/CVE-2026-84320.md): Nginx UI: Auto backup name allows path traversal outside validated storage path (CVSS 6.3, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-109427](https://cve.now/CVE-2026-109427.md): Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs (CVSS 7.1, weebzone Telegram-Stremio)
- [CVE-2026-109426](https://cve.now/CVE-2026-109426.md): Telegram-Stremio 5.1.0 Insecure Session Storage via encode\_string (CVSS 8.2, weebzone Telegram-Stremio)
- [CVE-2026-108929](https://cve.now/CVE-2026-108929.md): Netcore NR268 DDNS DDNSset.cgi execvp argument injection (CVSS 9.4, Netcore NR268)
- [CVE-2026-84318](https://cve.now/CVE-2026-84318.md): Nginx UI: MCP \`nginx\_config\_add\` Bypasses Directive Validation — Authenticated RCE (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-108928](https://cve.now/CVE-2026-108928.md): itsourcecode Online Admission System sum.php sql injection (CVSS 5.3, itsourcecode Online Admission System)
- [CVE-2026-97691](https://cve.now/CVE-2026-97691.md): Convex: Unauthorized data access (CVSS 4.3, get-convex convex-backend)
- [CVE-2026-106495](https://cve.now/CVE-2026-106495.md): Backstage: Improper access control in backend action invocation (CVSS 4.3, backstage · @backstage backend-defaults +1)
- [CVE-2026-92120](https://cve.now/CVE-2026-92120.md): Apache Allura: Oauth1 Replay Attack (CVSS 9.1, Apache Software Foundation Apache Allura)
- [CVE-2026-92119](https://cve.now/CVE-2026-92119.md): Apache Allura: REST API Mass Assignment (CVSS 9.1, Apache Software Foundation Apache Allura)
- [CVE-2026-84315](https://cve.now/CVE-2026-84315.md): Nginx UI OTP secure-session step-up is missing on sensitive mutation routes (CVSS 8.3, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-92116](https://cve.now/CVE-2026-92116.md): Apache Allura: OAuth1 missing callback validation (CVSS 9.1, Apache Software Foundation Apache Allura)
- [CVE-2026-41508](https://cve.now/CVE-2026-41508.md): OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART\_STRICT\_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (CVSS 5.8, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-108927](https://cve.now/CVE-2026-108927.md): itsourcecode Baptism Information Management System pbaptism.php sql injection (CVSS 5.3, itsourcecode Baptism Information Management System)
- [CVE-2026-41504](https://cve.now/CVE-2026-41504.md): OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields (CVSS 5.8, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-104774](https://cve.now/CVE-2026-104774.md): OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass (CVSS 5.8, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-41510](https://cve.now/CVE-2026-41510.md): OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding (CVSS 7.2, corazawaf coraza · github.com/corazawaf/coraza/v3 +2)
- [CVE-2026-109425](https://cve.now/CVE-2026-109425.md): Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets (CVSS 6.9, tink-crypto tink-go)
- [CVE-2026-95838](https://cve.now/CVE-2026-95838.md): containerd: Unpack DoS via repeated opaque whiteouts (CVSS 4.6, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-108926](https://cve.now/CVE-2026-108926.md): itsourcecode Baptism Information Management System ebaptism.php sql injection (CVSS 5.3, itsourcecode Baptism Information Management System)
- [CVE-2026-95837](https://cve.now/CVE-2026-95837.md): containerd CRI plugin: Checkpoint restore bypasses destination security context (CVSS 7.8, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-109424](https://cve.now/CVE-2026-109424.md): NetEase Cloud Music Weak Encryption via eapi/xeapi (CVSS 8.2, NetEase Cloud Music for Windows)
- [CVE-2026-109423](https://cve.now/CVE-2026-109423.md): NetEase Cloud Music TLS Certificate Validation Bypass (CVSS 9.1, NetEase Cloud Music for Windows)
- [CVE-2026-109422](https://cve.now/CVE-2026-109422.md): NetEase Cloud Music RCE via os.navigateExternal IPC (CVSS 9.2, NetEase Cloud Music for Windows)
- [CVE-2026-109575](https://cve.now/CVE-2026-109575.md): In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global auth (CVSS 9.8, HAProxy Data Plane API EE · HAProxy Data Plane API CE)
- [CVE-2026-96012](https://cve.now/CVE-2026-96012.md): IBM Db2 Mirror for i Privilege Escalation (CVSS 9.9, IBM Db2 Mirror for i)
- [CVE-2026-108924](https://cve.now/CVE-2026-108924.md): getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization (CVSS 5.3, getkirby Kirby)
- [CVE-2026-104364](https://cve.now/CVE-2026-104364.md): IBM® Db2® Denial of Service (CVSS 3.3, IBM Db2)
- [CVE-2026-104332](https://cve.now/CVE-2026-104332.md): IBM® Db2® Denial of Service (CVSS 5.5, IBM Db2)
- [CVE-2026-108923](https://cve.now/CVE-2026-108923.md): 1024-lab smart-admin Support Config Query queryByKey access control (CVSS 5.3, 1024-lab smart-admin)
- [CVE-2025-27895](https://cve.now/CVE-2025-27895.md): DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting (CVSS 6.1, IBM DB2 Recovery Expert for Linux, UNIX and Windows)
- [CVE-2025-27896](https://cve.now/CVE-2025-27896.md): IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting (CVSS 6.1, IBM DB2 Recovery Expert for Linux, UNIX and Windows)
- [CVE-2026-108361](https://cve.now/CVE-2026-108361.md): Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks (CVSS 7.2, Privasys ra-tls-clients)
- [CVE-2026-108362](https://cve.now/CVE-2026-108362.md): Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack) (CVSS 9.1, Privasys ra-tls-clients)
- [CVE-2025-27897](https://cve.now/CVE-2025-27897.md): IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting (CVSS 6.1, IBM DB2 Recovery Expert for Linux, UNIX and Windows)
- [CVE-2025-27902](https://cve.now/CVE-2025-27902.md): IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure (CVSS 6.1, IBM DB2 Recovery Expert for Linux, UNIX and Windows)
- [CVE-2026-108922](https://cve.now/CVE-2026-108922.md): KusalkaSilva Learning-Management-System upload\_save.php getimagesize unrestricted upload (CVSS 5.3, KusalkaSilva Learning-Management-System)
- [CVE-2026-65954](https://cve.now/CVE-2026-65954.md): PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() (CVSS 8.6, PHPCSStandards PHPCSUtils · phpcsstandards/phpcsutils)
- [CVE-2026-83535](https://cve.now/CVE-2026-83535.md): Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison (CVSS 7.4, Red Hat OpenStack Platform)
- [CVE-2026-83536](https://cve.now/CVE-2026-83536.md): Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris) (CVSS 5.3, Red Hat OpenStack Platform)
- [CVE-2026-85471](https://cve.now/CVE-2026-85471.md): Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable (CVSS 6.4, mirror registry for Red Hat OpenShift · Red Hat Quay)
- [CVE-2026-102663](https://cve.now/CVE-2026-102663.md): OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search (CVSS 4.3, OpenListTeam OpenList · github.com/OpenListTeam/OpenList… +2)
- [CVE-2026-57118](https://cve.now/CVE-2026-57118.md): PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints (CVSS 9.8, MervinPraison PraisonAI · MervinPraison praisonaiagents +1)
- [CVE-2026-57143](https://cve.now/CVE-2026-57143.md): PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search\_web tools via attacker-controlled searxng\_url parameter (CVSS 8.8, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-18166](https://cve.now/CVE-2026-18166.md): IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem (CVSS 7.7, IBM Db2)
- [CVE-2026-105464](https://cve.now/CVE-2026-105464.md): IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management (CVSS 8.8, IBM Db2)
- [CVE-2026-108921](https://cve.now/CVE-2026-108921.md): KusalkaSilva Learning-Management-System State-Changing Endpoints remove\_announcements.php mysql\_query missing authentication (CVSS 6.9, KusalkaSilva Learning-Management-System)
- [CVE-2026-89140](https://cve.now/CVE-2026-89140.md): Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state (CVSS 6.0, Temporal Technologies Temporal Server)
- [CVE-2026-104355](https://cve.now/CVE-2026-104355.md): Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces (CVSS 7.0, Temporal Technologies Temporal Server)
- [CVE-2026-105466](https://cve.now/CVE-2026-105466.md): IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions (CVSS 6.5, IBM Db2)
- [CVE-2026-87744](https://cve.now/CVE-2026-87744.md): Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations (CVSS 9.1, Red Hat build of Quarkus 3.27.6.redhat · Red Hat build o… +1)
- [CVE-2026-105465](https://cve.now/CVE-2026-105465.md): IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance (CVSS 8.8, IBM Db2)
- [CVE-2026-78404](https://cve.now/CVE-2026-78404.md): IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility (CVSS 6.5, IBM Db2)
- [CVE-2026-59976](https://cve.now/CVE-2026-59976.md): ConvertX: Path Traversal vulnerability leading to Arbitrary File Write (CVSS 8.1, C4illin ConvertX)
- [CVE-2026-59977](https://cve.now/CVE-2026-59977.md): ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction (CVSS 8.1, C4illin ConvertX)
- [CVE-2026-107226](https://cve.now/CVE-2026-107226.md): AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS (CVSS 6.8, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-104102](https://cve.now/CVE-2026-104102.md): copyparty FTP: upload outside defined volumes (limited path traversal) (CVSS 5.3, 9001 copyparty · copyparty)
- [CVE-2026-108920](https://cve.now/CVE-2026-108920.md): SourceCodester Drug Recommendation System Admin Record Tables user\_record.php cross site scripting (CVSS 5.3, SourceCodester Drug Recommendation System)
- [CVE-2026-103061](https://cve.now/CVE-2026-103061.md): Path traversal in Gleam via unvalidated package application names (CVSS 5.9, Gleam)
- [CVE-2026-108919](https://cve.now/CVE-2026-108919.md): SourceCodester Drug Recommendation System Student Registration add\_student.php cross site scripting (CVSS 5.3, SourceCodester Drug Recommendation System)
- [CVE-2026-108918](https://cve.now/CVE-2026-108918.md): Edimax BR-6208AC formWlanMP command injection (CVSS 10.0, Edimax BR-6208AC)
- [CVE-2026-77366](https://cve.now/CVE-2026-77366.md): obsidian-tc tokens can access arbitrary configured vaults (CVSS 9.9, The-40-Thieves obsidian-tc · obsidian-tc)
- [CVE-2026-77364](https://cve.now/CVE-2026-77364.md): obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets (CVSS 6.5, The-40-Thieves obsidian-tc · obsidian-tc)
- [CVE-2026-61994](https://cve.now/CVE-2026-61994.md): WordPress WP-Members plugin \<= 3.5.7 - Broken Access Control vulnerability (CVSS 5.4, RocketGeek WP-Members)
- [CVE-2026-42689](https://cve.now/CVE-2026-42689.md): WordPress Events Manager plugin \<= 7.4.7 - Race Condition vulnerability (CVSS 3.7, Pixelite Events Manager)
- [CVE-2026-77363](https://cve.now/CVE-2026-77363.md): obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access (CVSS 8.8, The-40-Thieves obsidian-tc · obsidian-tc)
- [CVE-2026-108917](https://cve.now/CVE-2026-108917.md): Edimax BR-6208AC formAutoFWupgrade command injection (CVSS 10.0, Edimax BR-6208AC)
- [CVE-2026-109448](https://cve.now/CVE-2026-109448.md): psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters (CVSS 5.9, PostgreSQL psqlODBC)
- [CVE-2026-108479](https://cve.now/CVE-2026-108479.md): WordPress Patreon WordPress plugin \<= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.1, Patreon WordPress)
- [CVE-2026-108481](https://cve.now/CVE-2026-108481.md): WordPress Patreon WordPress plugin \<= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.4, Patreon WordPress)
- [CVE-2026-103080](https://cve.now/CVE-2026-103080.md): WordPress Salevo plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.3, VillaTheme Salevo)
- [CVE-2026-108916](https://cve.now/CVE-2026-108916.md): Edimax BR-6208AC formAccept command injection (CVSS 6.9, Edimax BR-6208AC)
- [CVE-2026-6232](https://cve.now/CVE-2026-6232.md): Out-of-bounds write in LR11xx Transceiver (CVSS 5.2, Semtech LR1110 Transceiver · Semtech LR1110 Modem-e +3)
- [CVE-2026-108915](https://cve.now/CVE-2026-108915.md): Edimax BR-6208AC formWlanMP buffer overflow (CVSS 9.4, Edimax BR-6208AC)
- [CVE-2026-108482](https://cve.now/CVE-2026-108482.md): WordPress Premium Addons for Elementor plugin \<= 4.11.110 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LeapWorx Premium Addons for Elementor)
- [CVE-2026-107862](https://cve.now/CVE-2026-107862.md): WordPress Quiz And Survey Master plugin \<= 11.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ExpressTech Quiz And Survey Master)
- [CVE-2026-108486](https://cve.now/CVE-2026-108486.md): WordPress Forminator plugin \<= 1.58.0 - Broken Access Control vulnerability (CVSS 5.3, WPMU DEV Forminator)
- [CVE-2026-107418](https://cve.now/CVE-2026-107418.md): WordPress Booktics plugin \<= 1.0.28 - Broken Access Control vulnerability (CVSS 5.4, Arraytics Booktics)
- [CVE-2026-108478](https://cve.now/CVE-2026-108478.md): WordPress Element Pack Elementor Addons plugin \<= 8.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Element Pack Elementor Addons)
- [CVE-2026-108475](https://cve.now/CVE-2026-108475.md): WordPress Broadcast Live Video plugin \<= 7.3.6 - Broken Access Control vulnerability (CVSS 4.3, VideoWhisper.com Broadcast Live Video)
- [CVE-2026-108476](https://cve.now/CVE-2026-108476.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.5.13 - Broken Access Control vulnerability (CVSS 5.0, VideoWhisper.com Paid Videochat Turnkey Site)
- [CVE-2026-84286](https://cve.now/CVE-2026-84286.md): OOB Read/Write via Negative Array Index in exllamav3\_ext Kernel Table (CVSS 9.8, Turboderp-org ExLlamaV3)
- [CVE-2026-108914](https://cve.now/CVE-2026-108914.md): Edimax BR-6208AC formWlSiteSurvey buffer overflow (CVSS 9.4, Edimax BR-6208AC)
- [CVE-2026-85976](https://cve.now/CVE-2026-85976.md): HTTP response splitting in Progress MarkLogic Server Query Console (CVSS 5.4, Progress Software MarkLogic Server)
- [CVE-2026-85975](https://cve.now/CVE-2026-85975.md): Cleartext transmission in Progress MarkLogic Server Amazon S3 connections (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-85974](https://cve.now/CVE-2026-85974.md): Improper TLS hostname verification in Progress MarkLogic Server (CVSS 7.4, Progress Software MarkLogic Server)
- [CVE-2026-85973](https://cve.now/CVE-2026-85973.md): Cleartext transmission in Progress MarkLogic Server cluster join operations (CVSS 7.4, Progress Software MarkLogic Server)
- [CVE-2026-108909](https://cve.now/CVE-2026-108909.md): Netcore NR268 CGI Endpoint cross-site request forgery (CVSS 5.3, Netcore NR268)
- [CVE-2026-105274](https://cve.now/CVE-2026-105274.md): hex\_core decompresses registry and Erlang term API responses without size limits (CVSS 2.1, erlang rebar3 · hexpm hex\_core +2)
- [CVE-2026-85972](https://cve.now/CVE-2026-85972.md): Improper Kerberos server verification in Progress MarkLogic Server (CVSS 7.4, Progress Software MarkLogic Server)
- [CVE-2026-85971](https://cve.now/CVE-2026-85971.md): Incorrect log file permissions in Progress MarkLogic Server (CVSS 7.1, Progress Software MarkLogic Server)
- [CVE-2026-85970](https://cve.now/CVE-2026-85970.md): Improper XML external entity restriction in Progress MarkLogic Server (CVSS 7.1, Progress Software MarkLogic Server)
- [CVE-2026-85969](https://cve.now/CVE-2026-85969.md): Out-of-bounds write in Progress MarkLogic Server (CVSS 7.1, Progress Software MarkLogic Server)
- [CVE-2026-85968](https://cve.now/CVE-2026-85968.md): Out-of-bounds read in Progress MarkLogic Server (CVSS 7.1, Progress Software MarkLogic Server)
- [CVE-2026-75888](https://cve.now/CVE-2026-75888.md): Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch (CVSS 7.7, Red Hat OpenShift Container Platform)
- [CVE-2026-85967](https://cve.now/CVE-2026-85967.md): Cross-site scripting in Progress MarkLogic Server (CVSS 6.1, Progress Software MarkLogic Server)
- [CVE-2026-108477](https://cve.now/CVE-2026-108477.md): WordPress Booktics plugin \<= 1.0.28 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Booktics)
- [CVE-2026-85966](https://cve.now/CVE-2026-85966.md): Exposure of sensitive information in Progress MarkLogic Server (CVSS 7.7, Progress Software MarkLogic Server)
- [CVE-2026-108908](https://cve.now/CVE-2026-108908.md): Netcore NR268 Web UI l7\_call\_board\_user\_set.cgi eval cross site scripting (CVSS 4.8, Netcore NR268)
- [CVE-2026-85965](https://cve.now/CVE-2026-85965.md): Use-after-free in Progress MarkLogic Server JavaScript engine integration (CVSS 8.0, Progress Software MarkLogic Server)
- [CVE-2026-85964](https://cve.now/CVE-2026-85964.md): Path traversal in Progress MarkLogic Server Query Console (CVSS 7.7, Progress Software MarkLogic Server)
- [CVE-2026-85963](https://cve.now/CVE-2026-85963.md): Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-94451](https://cve.now/CVE-2026-94451.md): Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache (CVSS 6.5, Red Hat build of Quarkus 3.27.6.redhat · Red Hat build o… +1)
- [CVE-2026-108907](https://cve.now/CVE-2026-108907.md): Netcore NR268 CGI Execution user\_ok improper authentication (CVSS 10.0, Netcore NR268)
- [CVE-2026-85962](https://cve.now/CVE-2026-85962.md): Improper authentication in Progress MarkLogic Server SAML processing (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-85961](https://cve.now/CVE-2026-85961.md): Sensitive information exposure in Progress MarkLogic Server Azure deployments (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-85960](https://cve.now/CVE-2026-85960.md): Cross-site request forgery in Progress MarkLogic Server Query Console (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-85959](https://cve.now/CVE-2026-85959.md): Insufficient authentication logging in Progress MarkLogic Server (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-109374](https://cve.now/CVE-2026-109374.md): ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation (CVSS 5.1, zitadel)
- [CVE-2026-109373](https://cve.now/CVE-2026-109373.md): ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie (CVSS 9.2, zitadel)
- [CVE-2026-109372](https://cve.now/CVE-2026-109372.md): ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion (CVSS 9.3, zitadel)
- [CVE-2026-109371](https://cve.now/CVE-2026-109371.md): ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 (CVSS 8.8, zitadel)
- [CVE-2026-109366](https://cve.now/CVE-2026-109366.md): Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height (CVSS 6.3, ZcashFoundation zebra)
- [CVE-2026-109365](https://cve.now/CVE-2026-109365.md): Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies (CVSS 6.3, ZcashFoundation zebra)
- [CVE-2026-109364](https://cve.now/CVE-2026-109364.md): Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying (CVSS 6.9, ZcashFoundation zebra)
- [CVE-2026-109363](https://cve.now/CVE-2026-109363.md): Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction (CVSS 8.7, ZcashFoundation zebra)
- [CVE-2026-109362](https://cve.now/CVE-2026-109362.md): Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens (CVSS 5.3, heymrun heym)
- [CVE-2026-109361](https://cve.now/CVE-2026-109361.md): MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing\_file Path (CVSS 7.0, Project-MONAI MONAI)
- [CVE-2026-109360](https://cve.now/CVE-2026-109360.md): MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP (CVSS 7.7, Project-MONAI MONAI)
- [CVE-2026-109359](https://cve.now/CVE-2026-109359.md): Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery (CVSS 8.7, edgelesssys contrast)
- [CVE-2026-109358](https://cve.now/CVE-2026-109358.md): Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation (CVSS 8.5, edgelesssys contrast)
- [CVE-2026-109357](https://cve.now/CVE-2026-109357.md): LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header (CVSS 9.2, librenms)
- [CVE-2026-109356](https://cve.now/CVE-2026-109356.md): LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController (CVSS 5.3, librenms)
- [CVE-2026-109355](https://cve.now/CVE-2026-109355.md): LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List (CVSS 5.3, librenms)
- [CVE-2026-109354](https://cve.now/CVE-2026-109354.md): LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter (CVSS 5.3, librenms)
- [CVE-2026-109353](https://cve.now/CVE-2026-109353.md): LibreNMS before 26.9.0 SQL Injection via notification\_id in notifications.inc.php (CVSS 7.1, librenms)
- [CVE-2026-109352](https://cve.now/CVE-2026-109352.md): LibreNMS before 26.9.0 Stored XSS via wireless sensor description (CVSS 5.3, librenms)
- [CVE-2026-109351](https://cve.now/CVE-2026-109351.md): Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count (CVSS 7.1, GitoxideLabs gix-pack)
- [CVE-2026-109350](https://cve.now/CVE-2026-109350.md): Gitoxide gix-pack before 0.75.0 Denial of Service via OFS\_DELTA Base Distance (CVSS 7.1, GitoxideLabs gix-pack)
- [CVE-2026-109349](https://cve.now/CVE-2026-109349.md): gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header (CVSS 7.1, GitoxideLabs gix-pack)
- [CVE-2026-109348](https://cve.now/CVE-2026-109348.md): Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing (CVSS 5.3, GitoxideLabs gix-mailmap)
- [CVE-2026-109347](https://cve.now/CVE-2026-109347.md): Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass (CVSS 8.6, vrana adminer)
- [CVE-2026-109346](https://cve.now/CVE-2026-109346.md): better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device (CVSS 8.5, better-auth)
- [CVE-2026-109345](https://cve.now/CVE-2026-109345.md): DOMPurify before 3.4.16 XSS via IN\_PLACE Returned Rawtext Root (CVSS 5.1, cure53 DOMPurify · dompurify)
- [CVE-2026-109344](https://cve.now/CVE-2026-109344.md): DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN\_PLACE afterSanitize Hooks (CVSS 5.1, cure53 DOMPurify · dompurify)
- [CVE-2026-109343](https://cve.now/CVE-2026-109343.md): SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement (CVSS 8.6, surrealdb)
- [CVE-2026-109342](https://cve.now/CVE-2026-109342.md): SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method (CVSS 5.3, surrealdb)
- [CVE-2026-109341](https://cve.now/CVE-2026-109341.md): SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations (CVSS 7.1, surrealdb)
- [CVE-2026-109340](https://cve.now/CVE-2026-109340.md): SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE (CVSS 5.3, surrealdb)
- [CVE-2026-109339](https://cve.now/CVE-2026-109339.md): SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering (CVSS 6.9, surrealdb)
- [CVE-2026-109338](https://cve.now/CVE-2026-109338.md): SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values (CVSS 7.1, surrealdb)
- [CVE-2026-109337](https://cve.now/CVE-2026-109337.md): SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause (CVSS 5.3, surrealdb)
- [CVE-2026-109336](https://cve.now/CVE-2026-109336.md): SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after (CVSS 5.3, surrealdb)
- [CVE-2026-109335](https://cve.now/CVE-2026-109335.md): SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields (CVSS 7.1, surrealdb)
- [CVE-2026-109334](https://cve.now/CVE-2026-109334.md): SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use (CVSS 8.6, surrealdb)
- [CVE-2026-109333](https://cve.now/CVE-2026-109333.md): SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH (CVSS 7.1, surrealdb)
- [CVE-2026-109332](https://cve.now/CVE-2026-109332.md): Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport (CVSS 2.3, Jovancoding Network-AI)
- [CVE-2026-109331](https://cve.now/CVE-2026-109331.md): Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget (CVSS 7.5, Jovancoding Network-AI)
- [CVE-2026-109330](https://cve.now/CVE-2026-109330.md): Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer (CVSS 5.3, Jovancoding Network-AI)
- [CVE-2026-109329](https://cve.now/CVE-2026-109329.md): Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members\_assignment.php (CVSS 8.5, admidio)
- [CVE-2026-109328](https://cve.now/CVE-2026-109328.md): Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name (CVSS 5.3, admidio)
- [CVE-2026-109327](https://cve.now/CVE-2026-109327.md): Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php (CVSS 5.1, admidio)
- [CVE-2026-109326](https://cve.now/CVE-2026-109326.md): Grav before 2.1.7 Information Disclosure via Nested .git Directories (CVSS 8.7, getgrav grav)
- [CVE-2026-109325](https://cve.now/CVE-2026-109325.md): Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy (CVSS 8.7, getgrav grav)
- [CVE-2026-109324](https://cve.now/CVE-2026-109324.md): Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms (CVSS 7.1, getgrav grav)
- [CVE-2026-109323](https://cve.now/CVE-2026-109323.md): Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote\_access Authorization (CVSS 6.9, getgrav grav-plugin-star-ratings)
- [CVE-2026-109322](https://cve.now/CVE-2026-109322.md): Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views (CVSS 5.3, getgrav grav-plugin-guestbook)
- [CVE-2026-109321](https://cve.now/CVE-2026-109321.md): Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass (CVSS 9.3, getgrav grav-plugin-login-oauth)
- [CVE-2026-109320](https://cve.now/CVE-2026-109320.md): Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass (CVSS 5.3, getgrav grav-plugin-api)
- [CVE-2026-109319](https://cve.now/CVE-2026-109319.md): Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation (CVSS 5.3, getgrav grav-plugin-guestbook)
- [CVE-2026-109318](https://cve.now/CVE-2026-109318.md): Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author (CVSS 8.7, trilbymedia grav-plugin-git-sync)
- [CVE-2026-109317](https://cve.now/CVE-2026-109317.md): Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants (CVSS 8.6, getgrav grav-plugin-api)
- [CVE-2026-109316](https://cve.now/CVE-2026-109316.md): Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin (CVSS 6.9, getgrav grav-plugin-data-manager)
- [CVE-2026-109315](https://cve.now/CVE-2026-109315.md): Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox (CVSS 7.1, getgrav grav)
- [CVE-2026-109314](https://cve.now/CVE-2026-109314.md): Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page (CVSS 8.5, getgrav grav-plugin-login)
- [CVE-2026-109313](https://cve.now/CVE-2026-109313.md): Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie (CVSS 8.6, getgrav grav-plugin-login)
- [CVE-2026-109312](https://cve.now/CVE-2026-109312.md): Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form (CVSS 8.6, getgrav grav-plugin-login)
- [CVE-2026-109311](https://cve.now/CVE-2026-109311.md): vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload (CVSS 7.1, vllm-project vllm)
- [CVE-2026-109310](https://cve.now/CVE-2026-109310.md): SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template (CVSS 7.1, siyuan-note siyuan)
- [CVE-2026-109309](https://cve.now/CVE-2026-109309.md): SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-109308](https://cve.now/CVE-2026-109308.md): Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection (CVSS 8.7, craftcms cms)
- [CVE-2026-109307](https://cve.now/CVE-2026-109307.md): Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification (CVSS 2.1, craftcms cms)
- [CVE-2026-109306](https://cve.now/CVE-2026-109306.md): Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition (CVSS 6.0, craftcms cms)
- [CVE-2026-109305](https://cve.now/CVE-2026-109305.md): Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every (CVSS 8.7, craftcms cms)
- [CVE-2026-109304](https://cve.now/CVE-2026-109304.md): Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument (CVSS 6.9, craftcms cms)
- [CVE-2026-109303](https://cve.now/CVE-2026-109303.md): Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query (CVSS 5.3, parse-community parse-server · parse)
- [CVE-2026-109302](https://cve.now/CVE-2026-109302.md): Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries (CVSS 6.3, parse-community parse-server · parse)
- [CVE-2026-109301](https://cve.now/CVE-2026-109301.md): Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL (CVSS 8.2, parse-community parse-server · parse)
- [CVE-2026-109300](https://cve.now/CVE-2026-109300.md): Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds (CVSS 5.1, open-webui)
- [CVE-2026-109299](https://cve.now/CVE-2026-109299.md): Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation (CVSS 7.1, open-webui)
- [CVE-2026-109298](https://cve.now/CVE-2026-109298.md): Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex (CVSS 7.1, open-webui)
- [CVE-2026-109297](https://cve.now/CVE-2026-109297.md): Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules (CVSS 7.1, open-webui)
- [CVE-2026-109296](https://cve.now/CVE-2026-109296.md): Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes (CVSS 5.3, open-webui)
- [CVE-2026-109295](https://cve.now/CVE-2026-109295.md): Open WebUI 0.11.0 before 0.11.4 ReDoS via grep\_knowledge\_files Event Loop (CVSS 5.3, open-webui)
- [CVE-2026-109294](https://cve.now/CVE-2026-109294.md): Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image (CVSS 7.1, open-webui)
- [CVE-2026-109293](https://cve.now/CVE-2026-109293.md): Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint (CVSS 7.1, open-webui)
- [CVE-2026-109292](https://cve.now/CVE-2026-109292.md): Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections (CVSS 7.6, open-webui)
- [CVE-2026-109291](https://cve.now/CVE-2026-109291.md): Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed\_url (CVSS 8.5, open-webui)
- [CVE-2026-109290](https://cve.now/CVE-2026-109290.md): Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview (CVSS 8.4, open-webui)
- [CVE-2026-109289](https://cve.now/CVE-2026-109289.md): Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket (CVSS 5.3, open-webui)
- [CVE-2026-109288](https://cve.now/CVE-2026-109288.md): Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links (CVSS 7.2, open-webui)
- [CVE-2026-109287](https://cve.now/CVE-2026-109287.md): Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID (CVSS 5.3, open-webui)
- [CVE-2026-109286](https://cve.now/CVE-2026-109286.md): Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal (CVSS 8.6, open-webui)
- [CVE-2026-109285](https://cve.now/CVE-2026-109285.md): Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata (CVSS 2.3, open-webui)
- [CVE-2026-109284](https://cve.now/CVE-2026-109284.md): Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint (CVSS 5.3, open-webui)
- [CVE-2026-109283](https://cve.now/CVE-2026-109283.md): Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange (CVSS 5.3, open-webui)
- [CVE-2026-109282](https://cve.now/CVE-2026-109282.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders (CVSS 2.0, ImageMagick)
- [CVE-2026-109281](https://cve.now/CVE-2026-109281.md): ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option (CVSS 4.8, ImageMagick)
- [CVE-2026-109280](https://cve.now/CVE-2026-109280.md): ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option (CVSS 2.0, ImageMagick)
- [CVE-2026-109279](https://cve.now/CVE-2026-109279.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access (CVSS 2.0, ImageMagick)
- [CVE-2026-109278](https://cve.now/CVE-2026-109278.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation (CVSS 6.3, ImageMagick)
- [CVE-2026-109277](https://cve.now/CVE-2026-109277.md): ImageMagick before 7.1.2-32 Policy Bypass via -script Operation (CVSS 4.8, ImageMagick)
- [CVE-2026-109276](https://cve.now/CVE-2026-109276.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder (CVSS 6.9, ImageMagick)
- [CVE-2026-109275](https://cve.now/CVE-2026-109275.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder (CVSS 6.3, ImageMagick)
- [CVE-2026-109274](https://cve.now/CVE-2026-109274.md): ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script (CVSS 2.0, ImageMagick)
- [CVE-2026-109273](https://cve.now/CVE-2026-109273.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder (CVSS 6.9, ImageMagick)
- [CVE-2026-109272](https://cve.now/CVE-2026-109272.md): ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder (CVSS 6.3, ImageMagick)
- [CVE-2026-109271](https://cve.now/CVE-2026-109271.md): ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder (CVSS 6.3, ImageMagick)
- [CVE-2026-109270](https://cve.now/CVE-2026-109270.md): ImageMagick before 7.1.2-32 Memory Leak via -process Option (CVSS 4.8, ImageMagick)
- [CVE-2026-109269](https://cve.now/CVE-2026-109269.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder (CVSS 6.9, ImageMagick)
- [CVE-2026-109268](https://cve.now/CVE-2026-109268.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000 (CVSS 6.3, ImageMagick)
- [CVE-2026-109267](https://cve.now/CVE-2026-109267.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder (CVSS 6.9, ImageMagick)
- [CVE-2026-109266](https://cve.now/CVE-2026-109266.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder (CVSS 6.9, ImageMagick)
- [CVE-2026-109265](https://cve.now/CVE-2026-109265.md): ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile (CVSS 6.9, ImageMagick)
- [CVE-2026-109264](https://cve.now/CVE-2026-109264.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder (CVSS 6.3, ImageMagick)
- [CVE-2026-109263](https://cve.now/CVE-2026-109263.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder (CVSS 6.3, ImageMagick)
- [CVE-2026-109262](https://cve.now/CVE-2026-109262.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder (CVSS 6.9, ImageMagick)
- [CVE-2026-109261](https://cve.now/CVE-2026-109261.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder (CVSS 6.3, ImageMagick)
- [CVE-2026-109260](https://cve.now/CVE-2026-109260.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder (CVSS 6.3, ImageMagick)
- [CVE-2026-109259](https://cve.now/CVE-2026-109259.md): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder (CVSS 6.9, ImageMagick)
- [CVE-2026-109258](https://cve.now/CVE-2026-109258.md): ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation (CVSS 2.0, ImageMagick)
- [CVE-2026-109257](https://cve.now/CVE-2026-109257.md): FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure (CVSS 8.2, FreeRDP)
- [CVE-2026-109256](https://cve.now/CVE-2026-109256.md): FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion (CVSS 6.0, FreeRDP)
- [CVE-2026-109255](https://cve.now/CVE-2026-109255.md): FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license\_check\_stream\_length (CVSS 6.1, FreeRDP)
- [CVE-2026-109254](https://cve.now/CVE-2026-109254.md): FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path (CVSS 6.0, FreeRDP)
- [CVE-2026-109253](https://cve.now/CVE-2026-109253.md): FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read (CVSS 6.0, FreeRDP)
- [CVE-2026-109252](https://cve.now/CVE-2026-109252.md): FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB\_RPC\_INTERNAL\_NAME (CVSS 6.0, FreeRDP)
- [CVE-2026-109251](https://cve.now/CVE-2026-109251.md): FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry (CVSS 6.0, FreeRDP)
- [CVE-2026-109250](https://cve.now/CVE-2026-109250.md): FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect\_keys() (CVSS 7.0, FreeRDP)
- [CVE-2026-109249](https://cve.now/CVE-2026-109249.md): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing (CVSS 6.8, FreeRDP)
- [CVE-2026-109248](https://cve.now/CVE-2026-109248.md): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName (CVSS 6.9, FreeRDP)
- [CVE-2026-109247](https://cve.now/CVE-2026-109247.md): FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName (CVSS 2.1, FreeRDP)
- [CVE-2026-109246](https://cve.now/CVE-2026-109246.md): FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU (CVSS 7.1, FreeRDP)
- [CVE-2026-109245](https://cve.now/CVE-2026-109245.md): FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp\_http\_request (CVSS 7.4, FreeRDP)
- [CVE-2026-109244](https://cve.now/CVE-2026-109244.md): FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert (CVSS 6.8, FreeRDP)
- [CVE-2026-109243](https://cve.now/CVE-2026-109243.md): FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File (CVSS 4.1, FreeRDP)
- [CVE-2026-109242](https://cve.now/CVE-2026-109242.md): FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade (CVSS 7.1, FreeRDP)
- [CVE-2026-109241](https://cve.now/CVE-2026-109241.md): FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel (CVSS 2.3, FreeRDP)
- [CVE-2026-109240](https://cve.now/CVE-2026-109240.md): FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb\_isoch\_transfer (CVSS 2.3, FreeRDP)
- [CVE-2026-109239](https://cve.now/CVE-2026-109239.md): Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can\_fetch robots.txt Fetch (CVSS 6.9, unclecode crawl4ai)
- [CVE-2026-109238](https://cve.now/CVE-2026-109238.md): Crawl4AI 0.7.0 before 0.9.4 SSRF via link\_preview\_config URL Seeder (CVSS 9.2, unclecode crawl4ai)
- [CVE-2026-109237](https://cve.now/CVE-2026-109237.md): Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables (CVSS 8.6, unclecode crawl4ai)
- [CVE-2026-85958](https://cve.now/CVE-2026-85958.md): Improper OAuth token validation in Progress MarkLogic Server (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-85957](https://cve.now/CVE-2026-85957.md): Improper XML external entity restriction in Progress MarkLogic Server SAML processing (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-85956](https://cve.now/CVE-2026-85956.md): Improper privilege management in Progress MarkLogic Server backup and restore operations (CVSS 9.6, Progress Software MarkLogic Server)
- [CVE-2026-108906](https://cve.now/CVE-2026-108906.md): Netcore NR268 filter\_arp\_put\_file.cgi filter\_arp\_put\_file\_cgi out-of-bounds (CVSS 8.6, Netcore NR268)
- [CVE-2026-85955](https://cve.now/CVE-2026-85955.md): Improper privilege management in Progress MarkLogic Server xdmp:eval-in (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-85954](https://cve.now/CVE-2026-85954.md): Improper privilege management in Progress MarkLogic Server higher-order XQuery functions (CVSS 8.6, Progress Software MarkLogic Server)
- [CVE-2026-85953](https://cve.now/CVE-2026-85953.md): Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio (CVSS 8.5, Progress Software MarkLogic Server)
- [CVE-2026-85952](https://cve.now/CVE-2026-85952.md): Server-side request forgery in Progress MarkLogic Server Linux cloud deployments (CVSS 8.5, Progress Software MarkLogic Server)
- [CVE-2026-85951](https://cve.now/CVE-2026-85951.md): Server-side request forgery in Progress MarkLogic Server Azure deployments (CVSS 8.5, Progress Software MarkLogic Server)
- [CVE-2026-81856](https://cve.now/CVE-2026-81856.md): Terminal escape sequence injection in Hex via unneutralized server-supplied output (CVSS 2.3, hexpm hex)
- [CVE-2026-108901](https://cve.now/CVE-2026-108901.md): Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer (CVSS 5.1, Shenzhen HCC Technology MPOS M6 PLUS)
- [CVE-2026-103060](https://cve.now/CVE-2026-103060.md): Path traversal in rebar3 via unvalidated dependency app names (CVSS 7.5, erlang rebar3)
- [CVE-2026-85950](https://cve.now/CVE-2026-85950.md): Improper privilege management in Progress MarkLogic Server REST extensions (CVSS 8.4, Progress Software MarkLogic Server)
- [CVE-2026-96612](https://cve.now/CVE-2026-96612.md): Path traversal in Hex via unvalidated dependency app names (CVSS 7.5, hexpm hex)
- [CVE-2026-85949](https://cve.now/CVE-2026-85949.md): Sensitive information exposure in Progress MarkLogic Server trace logs (CVSS 8.1, Progress Software MarkLogic Server)
- [CVE-2026-85948](https://cve.now/CVE-2026-85948.md): Improper privilege management in Progress MarkLogic Server Management API (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-85947](https://cve.now/CVE-2026-85947.md): Improper privilege management in Progress MarkLogic Server forest operations (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-9191](https://cve.now/CVE-2026-9191.md): Insufficient isolation of user-supplied code in Progress MarkLogic Server (CVSS 9.6, Progress Software MarkLogic Server)
- [CVE-2026-105668](https://cve.now/CVE-2026-105668.md): Hex release-age cooldown is lifted package-wide when the locked release is retired (CVSS 7.1, hexpm hex)
- [CVE-2026-108900](https://cve.now/CVE-2026-108900.md): Exponent CMS XML-RPC xmlrpc.php userLogin sql injection (CVSS 6.9, Exponent CMS)
- [CVE-2026-105280](https://cve.now/CVE-2026-105280.md): Hex writes unverified package tarballs to standard output in mix hex.package fetch (CVSS 6.9, hexpm hex)
- [CVE-2026-96618](https://cve.now/CVE-2026-96618.md): Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror (CVSS 2.1, hexpm hex)
- [CVE-2026-109195](https://cve.now/CVE-2026-109195.md): Quay: repository auto-prune policy uuid idor in quay api (CVSS 3.1, Red Hat Quay)
- [CVE-2026-109194](https://cve.now/CVE-2026-109194.md): Quay: build trigger uuid idor in quay api (CVSS 6.4, Red Hat Quay)
- [CVE-2026-103503](https://cve.now/CVE-2026-103503.md): Hex trusts its bundled CA certificates when cacerts\_path is set (CVSS 5.9, hexpm hex)
- [CVE-2026-109399](https://cve.now/CVE-2026-109399.md): SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates (CVSS 9.2, sbabic swupdate)
- [CVE-2026-109398](https://cve.now/CVE-2026-109398.md): Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs (CVSS 8.7, gumlet php-image-resize)
- [CVE-2026-109397](https://cve.now/CVE-2026-109397.md): Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space (CVSS 8.6, Thelia)
- [CVE-2026-109396](https://cve.now/CVE-2026-109396.md): Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports (CVSS 2.3, Thelia)
- [CVE-2026-109394](https://cve.now/CVE-2026-109394.md): Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout (CVSS 9.1, thirty bees)
- [CVE-2026-109393](https://cve.now/CVE-2026-109393.md): QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers (CVSS 5.3, Webkul QloApps)
- [CVE-2026-109392](https://cve.now/CVE-2026-109392.md): Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview (CVSS 5.1, Pimcore)
- [CVE-2026-109391](https://cve.now/CVE-2026-109391.md): Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API (CVSS 9.2, Square Squash)
- [CVE-2026-108899](https://cve.now/CVE-2026-108899.md): tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization (CVSS 6.9, tobychui zoraxy)
- [CVE-2026-92681](https://cve.now/CVE-2026-92681.md): @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields (CVSS 9.3, @neo4j/graphql)
- [CVE-2026-92682](https://cve.now/CVE-2026-92682.md): @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier (CVSS 8.6, @neo4j/graphql)
- [CVE-2026-107248](https://cve.now/CVE-2026-107248.md): CVE-2026-107248 (CVSS 8.8, Thelia)
- [CVE-2026-108898](https://cve.now/CVE-2026-108898.md): Netis WF2409E Wireless Settings cross site scripting (CVSS 5.1, Netis WF2409E)
- [CVE-2026-103537](https://cve.now/CVE-2026-103537.md): CVE-2026-103537 (CVSS 5.4, Thelia)
- [CVE-2026-103535](https://cve.now/CVE-2026-103535.md): CVE-2026-103535 (CVSS 8.8, Thelia)
- [CVE-2026-103529](https://cve.now/CVE-2026-103529.md): CVE-2026-103529 (CVSS 5.4, Thelia)
- [CVE-2026-103528](https://cve.now/CVE-2026-103528.md): CVE-2026-103528 (CVSS 5.4, Thelia)
- [CVE-2026-103527](https://cve.now/CVE-2026-103527.md): CVE-2026-103527 (CVSS 6.1, Thelia)
- [CVE-2026-103526](https://cve.now/CVE-2026-103526.md): CVE-2026-103526 (CVSS 3.7, Thelia)
- [CVE-2026-103524](https://cve.now/CVE-2026-103524.md): CVE-2026-103524 (CVSS 4.8, Thelia)
- [CVE-2026-103523](https://cve.now/CVE-2026-103523.md): CVE-2026-103523 (CVSS 6.1, Thelia)
- [CVE-2026-103522](https://cve.now/CVE-2026-103522.md): CVE-2026-103522 (CVSS 7.2, Thelia)
- [CVE-2026-103521](https://cve.now/CVE-2026-103521.md): CVE-2026-103521 (CVSS 7.2, Thelia)
- [CVE-2026-108897](https://cve.now/CVE-2026-108897.md): Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine (CVSS 6.9, Smart Media4U Technology SHAREit App)
- [CVE-2026-108094](https://cve.now/CVE-2026-108094.md): Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-109390](https://cve.now/CVE-2026-109390.md): AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on (CVSS 9.8, AnyDesk)
- [CVE-2026-108896](https://cve.now/CVE-2026-108896.md): Linksys E1700 setLinksysIpv6 os command injection (CVSS 9.4, Linksys E1700)
- [CVE-2026-92877](https://cve.now/CVE-2026-92877.md): The JAXB factory methods historically relied solely on \`FEATURE\_SECURE\_PROCESSING\` to prevent XML External Entity (XXE) resolution. (CVSS 8.3, Eclipse Foundation jaxb-ri)
- [CVE-2026-108895](https://cve.now/CVE-2026-108895.md): Linksys E1700 setDMZ os command injection (CVSS 9.4, Linksys E1700)
- [CVE-2026-109229](https://cve.now/CVE-2026-109229.md): SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor (CVSS 8.7, sgl-project sglang)
- [CVE-2026-109228](https://cve.now/CVE-2026-109228.md): SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters (CVSS 8.7, sgl-project sglang)
- [CVE-2026-109227](https://cve.now/CVE-2026-109227.md): SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing (CVSS 8.7, sgl-project sglang)
- [CVE-2026-109226](https://cve.now/CVE-2026-109226.md): SGLang through 0.5.21 Audio Decompression Amplification via load\_audio (CVSS 8.7, sgl-project sglang)
- [CVE-2026-109225](https://cve.now/CVE-2026-109225.md): SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload (CVSS 8.7, sgl-project sglang)
- [CVE-2026-12613](https://cve.now/CVE-2026-12613.md): Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor (CVSS 8.8, Ministry of Justice General Directorate of Information Tech…)
- [CVE-2026-108894](https://cve.now/CVE-2026-108894.md): Linksys E1700 Static Route addStaticRoute os command injection (CVSS 9.4, Linksys E1700)
- [CVE-2026-18390](https://cve.now/CVE-2026-18390.md): Command Injection in Ministry of Justice's UYAP Document Editor (CVSS 7.8, Ministry of Justice General Directorate of Information Tech…)
- [CVE-2026-108893](https://cve.now/CVE-2026-108893.md): Linksys E1700 setVlan stack-based overflow (CVSS 9.4, Linksys E1700)
- [CVE-2026-109206](https://cve.now/CVE-2026-109206.md): LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet (CVSS 6.9, LogicalDOC Community Edition)
- [CVE-2026-109205](https://cve.now/CVE-2026-109205.md): LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet (CVSS 8.7, LogicalDOC Community Edition)
- [CVE-2026-109204](https://cve.now/CVE-2026-109204.md): LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket (CVSS 5.3, LogicalDOC Community Edition)
- [CVE-2026-109203](https://cve.now/CVE-2026-109203.md): LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet (CVSS 7.1, LogicalDOC Community Edition)
- [CVE-2026-109202](https://cve.now/CVE-2026-109202.md): LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet (CVSS 7.1, LogicalDOC Community Edition)
- [CVE-2026-109201](https://cve.now/CVE-2026-109201.md): LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService (CVSS 8.7, LogicalDOC Community Edition)
- [CVE-2026-109200](https://cve.now/CVE-2026-109200.md): LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href (CVSS 5.3, LogicalDOC Community Edition)
- [CVE-2026-109199](https://cve.now/CVE-2026-109199.md): LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template (CVSS 8.7, LogicalDOC Community Edition)
- [CVE-2026-109170](https://cve.now/CVE-2026-109170.md): LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter (CVSS 7.1, LogicalDOC Community Edition)
- [CVE-2026-109169](https://cve.now/CVE-2026-109169.md): LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter (CVSS 7.1, LogicalDOC Community Edition)
- [CVE-2026-108892](https://cve.now/CVE-2026-108892.md): Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow (CVSS 10.0, Linksys E1700)
- [CVE-2026-103502](https://cve.now/CVE-2026-103502.md): hex\_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 (CVSS 5.9, hexpm hex\_core · hex\_core)
- [CVE-2026-108890](https://cve.now/CVE-2026-108890.md): BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization (CVSS 5.3, BlackBeltTechnology pi-agent-dashboard)
- [CVE-2026-109188](https://cve.now/CVE-2026-109188.md): jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109187](https://cve.now/CVE-2026-109187.md): jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey (CVSS 7.1, jishenghua jshERP)
- [CVE-2026-109186](https://cve.now/CVE-2026-109186.md): jshERP through 3.6 Mass Assignment via PUT /user/update (CVSS 8.7, jishenghua jshERP)
- [CVE-2026-109185](https://cve.now/CVE-2026-109185.md): jshERP through 3.6 Privilege Escalation via PUT /user/updateUser (CVSS 8.7, jishenghua jshERP)
- [CVE-2026-109184](https://cve.now/CVE-2026-109184.md): jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109183](https://cve.now/CVE-2026-109183.md): jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109182](https://cve.now/CVE-2026-109182.md): jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109181](https://cve.now/CVE-2026-109181.md): jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109180](https://cve.now/CVE-2026-109180.md): jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109179](https://cve.now/CVE-2026-109179.md): jshERP through 3.6 Missing Authorization via /log/list and /log/info (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109178](https://cve.now/CVE-2026-109178.md): jshERP through 3.6 Missing Authorization via /log Audit Endpoints (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-109177](https://cve.now/CVE-2026-109177.md): MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit (CVSS 5.3, moxi624 MoguBlog)
- [CVE-2026-109176](https://cve.now/CVE-2026-109176.md): MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files (CVSS 5.3, moxi624 MoguBlog)
- [CVE-2026-109175](https://cve.now/CVE-2026-109175.md): MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList (CVSS 5.3, moxi624 MoguBlog)
- [CVE-2026-109174](https://cve.now/CVE-2026-109174.md): MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig (CVSS 7.1, moxi624 MoguBlog)
- [CVE-2026-109173](https://cve.now/CVE-2026-109173.md): yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint (CVSS 5.3, guchengwuyue yshop-crm)
- [CVE-2026-109172](https://cve.now/CVE-2026-109172.md): yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint (CVSS 5.3, guchengwuyue yshop-crm)
- [CVE-2026-109171](https://cve.now/CVE-2026-109171.md): yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check (CVSS 5.3, guchengwuyue yshop-crm)
- [CVE-2026-109168](https://cve.now/CVE-2026-109168.md): lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId (CVSS 7.1, dromara lamp-cloud)
- [CVE-2026-109167](https://cve.now/CVE-2026-109167.md): TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save (CVSS 5.3, TDuckCloud tduck-survey-form)
- [CVE-2026-109166](https://cve.now/CVE-2026-109166.md): lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById (CVSS 7.1, dromara lamp-cloud)
- [CVE-2026-109165](https://cve.now/CVE-2026-109165.md): TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create (CVSS 5.3, TDuckCloud tduck-survey-form)
- [CVE-2026-109164](https://cve.now/CVE-2026-109164.md): TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey} (CVSS 7.1, TDuckCloud tduck-survey-form)
- [CVE-2026-105081](https://cve.now/CVE-2026-105081.md): ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName (CVSS 2.0, ImageMagick)
- [CVE-2026-108889](https://cve.now/CVE-2026-108889.md): Yungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub\_14000443C exposed ioctl with insufficient access control (CVSS 4.8, Yungengxin Cloud Billing)
- [CVE-2026-93695](https://cve.now/CVE-2026-93695.md): Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService (CVSS 7.4, Progress ShareFile Storage Zones Controller)
- [CVE-2026-93694](https://cve.now/CVE-2026-93694.md): Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller (CVSS 4.0, Progress ShareFile Storage Zones Controller)
- [CVE-2026-93693](https://cve.now/CVE-2026-93693.md): Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller (CVSS 6.5, Progress ShareFile Storage Zones Controller)
- [CVE-2026-108836](https://cve.now/CVE-2026-108836.md): Ollama Pull API name.go IsValid server-side request forgery (CVSS 6.9, Ollama)
- [CVE-2026-108835](https://cve.now/CVE-2026-108835.md): Yungengxin Yun Jia Security Guard kgameprotect.sys sub\_14000885C privileges management (CVSS 4.8, Yungengxin Yun Jia Security Guard)
- [CVE-2026-52903](https://cve.now/CVE-2026-52903.md): YAML safe\_load production fallback to unsafe\_load enables RCE via deserialization (CVSS 8.8, ManageIQ · Red Hat CloudForms)
- [CVE-2026-108834](https://cve.now/CVE-2026-108834.md): Cairo-dock Glx-Dock Query Parameter ww\_page.php cross site scripting (CVSS 5.3, Cairo-dock Glx-Dock)
- [CVE-2026-108953](https://cve.now/CVE-2026-108953.md): mac-shell-mcp before 2.0.0 OS Command Injection via execute\_command Arguments (CVSS 8.5, cfdude mac-shell-mcp)
- [CVE-2026-108952](https://cve.now/CVE-2026-108952.md): RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver (CVSS 5.1, rt-thread)
- [CVE-2026-108951](https://cve.now/CVE-2026-108951.md): LavaLite CMS through 10.1.2 Authorization Bypass via User Update API (CVSS 7.1, lavalite cms)
- [CVE-2026-108950](https://cve.now/CVE-2026-108950.md): Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes (CVSS 6.9, opensource-socialnetwork)
- [CVE-2026-108831](https://cve.now/CVE-2026-108831.md): meetecho janus-gateway Admin API admin.js hard-coded credentials (CVSS 5.3, meetecho janus-gateway)
- [CVE-2026-108830](https://cve.now/CVE-2026-108830.md): meetecho janus-gateway VideoRoom janus\_videoroom.c race condition (CVSS 2.3, meetecho janus-gateway)
- [CVE-2026-108829](https://cve.now/CVE-2026-108829.md): Zen Cart Module Configuration modules.php sql injection (CVSS 5.1, Zen Cart)
- [CVE-2026-105283](https://cve.now/CVE-2026-105283.md): Internal error terms inspected into AshTypescript RPC error responses (CVSS 6.3, ash-project ash\_typescript · ash\_typescript)
- [CVE-2026-108828](https://cve.now/CVE-2026-108828.md): Zen Cart Admin Panel configuration.php eval sql injection (CVSS 2.1, Zen Cart)
- [CVE-2026-85499](https://cve.now/CVE-2026-85499.md): Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/\* proxy (CVSS 9.1, Apache Software Foundation Apache SkyWalking BanyanDB)
- [CVE-2026-108827](https://cve.now/CVE-2026-108827.md): Zen Cart Administrative Module Management general.php zen\_call\_function code injection (CVSS 2.1, Zen Cart)
- [CVE-2026-105412](https://cve.now/CVE-2026-105412.md): SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 (CVSS 7.1, Dassault Systèmes Tuleap Enterprise Edition)
- [CVE-2026-105411](https://cve.now/CVE-2026-105411.md): Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (CVSS 8.1, Dassault Systèmes Tuleap Enterprise Edition)
- [CVE-2026-108826](https://cve.now/CVE-2026-108826.md): Zen Cart PayPal IPN paypaldp.php zen\_db\_perform sql injection (CVSS 6.9, Zen Cart)
- [CVE-2026-105410](https://cve.now/CVE-2026-105410.md): Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (CVSS 8.7, Dassault Systèmes Tuleap Enterprise Edition)
- [CVE-2026-105409](https://cve.now/CVE-2026-105409.md): Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (CVSS 8.7, Dassault Systèmes Tuleap Enterprise Edition)
- [CVE-2026-105408](https://cve.now/CVE-2026-105408.md): Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (CVSS 8.7, Dassault Systèmes Tuleap Enterprise Edition)
- [CVE-2026-105407](https://cve.now/CVE-2026-105407.md): OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (CVSS 8.8, Dassault Systèmes Tuleap Enterprise Edition)
- [CVE-2026-103903](https://cve.now/CVE-2026-103903.md): MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation (CVSS 8.7, MikroTik RouterOS)
- [CVE-2026-108825](https://cve.now/CVE-2026-108825.md): yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management (CVSS 5.3, yangzongzhuan RuoYi)
- [CVE-2026-103902](https://cve.now/CVE-2026-103902.md): DigiDoc improper signature verification (CVSS 7.5, libdigidocpp · DigiDoc4 +2)
- [CVE-2026-108824](https://cve.now/CVE-2026-108824.md): DataEase Utils.java Utils.buildCalcField sql injection (CVSS 5.3, DataEase)
- [CVE-2026-108822](https://cve.now/CVE-2026-108822.md): Kamailio sipt ss7\_parser.c isup\_get\_calling\_party buffer overflow (CVSS 6.9, Kamailio)
- [CVE-2026-108821](https://cve.now/CVE-2026-108821.md): Tencent WeKnora SQL Validator inject.go validateSubquery sql injection (CVSS 5.3, Tencent WeKnora)
- [CVE-2026-108820](https://cve.now/CVE-2026-108820.md): agno-agi agno Delegation Feature \_default\_tools.py member\_agent.run unnecessary privileges (CVSS 5.3, agno-agi agno)
- [CVE-2026-108819](https://cve.now/CVE-2026-108819.md): agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources (CVSS 6.9, agno-agi agno)
- [CVE-2026-107864](https://cve.now/CVE-2026-107864.md): WordPress Ad Inserter plugin \<= 2.8.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Igor Funa Ad Inserter)
- [CVE-2026-107865](https://cve.now/CVE-2026-107865.md): WordPress JetMenu plugin \<= 3.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetMenu)
- [CVE-2026-108818](https://cve.now/CVE-2026-108818.md): agno-agi agno auth.py get\_authentication\_dependency missing authentication (CVSS 6.9, agno-agi agno)
- [CVE-2026-107866](https://cve.now/CVE-2026-107866.md): WordPress JetElements For Elementor plugin \<= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor)
- [CVE-2026-108817](https://cve.now/CVE-2026-108817.md): agno-agi agno CodingTools coding.py agno.CodingTools.run\_shell os command injection (CVSS 5.1, agno-agi agno)
- [CVE-2026-1907](https://cve.now/CVE-2026-1907.md): SQL Injection in Clustering Communication (Hybrid Mode) (CVSS 7.5, Kong Enterprise Gateway · Kong Gateway)
- [CVE-2026-108816](https://cve.now/CVE-2026-108816.md): agno-agi agno PythonTools python.py run\_python\_code code injection (CVSS 5.3, agno-agi agno)
- [CVE-2026-107423](https://cve.now/CVE-2026-107423.md): WordPress WP User Manager plugin \<= 2.9.22 - Broken Access Control vulnerability (CVSS 4.3, WP User Manager)
- [CVE-2026-107869](https://cve.now/CVE-2026-107869.md): WordPress Flexible Subscriptions plugin \<= 1.8.4 - Broken Access Control vulnerability (CVSS 4.3, WP Desk Flexible Subscriptions)
- [CVE-2026-107863](https://cve.now/CVE-2026-107863.md): WordPress Products Restricted Users for WooCommerce plugin \<= 0.7 - Broken Access Control vulnerability (CVSS 5.3, Codection Products Restricted Users for WooCommerce)
- [CVE-2026-108168](https://cve.now/CVE-2026-108168.md): WordPress Custom Query Blocks plugin \<= 5.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DLX Plugins Custom Query Blocks)
- [CVE-2023-25996](https://cve.now/CVE-2023-25996.md): WordPress Booster Elite for WooCommerce plugin \< 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability (CVSS 6.5, Pluggabl LLC. Booster Elite for WooCommerce)
- [CVE-2026-108815](https://cve.now/CVE-2026-108815.md): idcCMS member\_deal.php cross site scripting (CVSS 5.1, idcCMS)
- [CVE-2026-108814](https://cve.now/CVE-2026-108814.md): SEMCMS SEMCMS\_Banner.php sql injection (CVSS 5.3, SEMCMS)
- [CVE-2026-107432](https://cve.now/CVE-2026-107432.md): WordPress Event post plugin \<= 6.1.1 - Broken Access Control vulnerability (CVSS 5.4, NOUS Ouvert Utile et Simple Event post)
- [CVE-2026-103356](https://cve.now/CVE-2026-103356.md): WordPress TMDS plugin \<= 1.0.15 - Broken Access Control vulnerability (CVSS 5.4, VillaTheme TMDS)
- [CVE-2026-107430](https://cve.now/CVE-2026-107430.md): WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin \<= 1.2.10 - Broken Access Control vulnerability (CVSS 5.4, VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Cla…)
- [CVE-2026-108813](https://cve.now/CVE-2026-108813.md): SEMCMS SEMCMS\_Download.php sql injection (CVSS 5.3, SEMCMS)
- [CVE-2026-107429](https://cve.now/CVE-2026-107429.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.5.12 - Other vulnerability Type vulnerability (CVSS 4.3, VideoWhisper.com Paid Videochat Turnkey Site)
- [CVE-2026-107427](https://cve.now/CVE-2026-107427.md): WordPress Event post plugin \<= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, NOUS Ouvert Utile et Simple Event post)
- [CVE-2026-106605](https://cve.now/CVE-2026-106605.md): WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin \<= 2.3.22 - Other vulnerability Type vulnerability (CVSS 5.3, WP Desk Flexible Quantity – Measurement Price Calculator fo…)
- [CVE-2026-108812](https://cve.now/CVE-2026-108812.md): SEMCMS SEMCMS\_User.php user improper authorization (CVSS 6.9, SEMCMS)
- [CVE-2026-108811](https://cve.now/CVE-2026-108811.md): WMCMS index.php information disclosure (CVSS 5.3, WMCMS)
- [CVE-2026-108810](https://cve.now/CVE-2026-108810.md): tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure (CVSS 6.9, tsi-coop tsi-dpdp-cms)
- [CVE-2026-93582](https://cve.now/CVE-2026-93582.md): Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication (CVSS 9.4, OTRS GmbH (former OTRS AG) OTRS · OTRS GmbH (former OTRS AG…)
- [CVE-2026-93581](https://cve.now/CVE-2026-93581.md): Insufficient Neutralization of Formula Elements in CSV Exports (CVSS 6.1, OTRS GmbH (former OTRS AG) OTRS · OTRS GmbH (former OTRS AG…)
- [CVE-2026-78359](https://cve.now/CVE-2026-78359.md): Duplicate Identity / Identity Shadowing across CustomerUser backends (CVSS 5.4, OTRS GmbH (former OTRS AG) OTRS · OTRS GmbH (former OTRS AG…)
- [CVE-2026-78358](https://cve.now/CVE-2026-78358.md): Cross-Site Request Forgery in Administrative Actions (CVSS 4.3, OTRS GmbH (former OTRS AG) OTRS · OTRS GmbH (former OTRS AG…)
- [CVE-2026-78357](https://cve.now/CVE-2026-78357.md): Insufficient Session Revocation for JWT Authentication (CVSS 9.1, OTRS GmbH (former OTRS AG) OTRS)
- [CVE-2026-78356](https://cve.now/CVE-2026-78356.md): Unauthenticated Disclosure of Agent Frontend Configuration (CVSS 5.3, OTRS GmbH (former OTRS AG) OTRS)
- [CVE-2026-78355](https://cve.now/CVE-2026-78355.md): Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory (CVSS 8.7, OTRS GmbH (former OTRS AG) OTRS · OTRS GmbH (former OTRS AG…)
- [CVE-2026-48212](https://cve.now/CVE-2026-48212.md): Stored XSS in external pages (CVSS 4.8, OTRS GmbH (former OTRS AG) OTRS)
- [CVE-2026-48211](https://cve.now/CVE-2026-48211.md): Cross-Site Request Forgery in Import/Export Admin console (CVSS 5.4, OTRS GmbH (former OTRS AG) OTRS · OTRS GmbH (former OTRS AG…)
- [CVE-2026-108809](https://cve.now/CVE-2026-108809.md): Eleveo Call Recording Software logout session expiration (CVSS 5.1, Eleveo Call Recording Software)
- [CVE-2026-108808](https://cve.now/CVE-2026-108808.md): Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings (CVSS 2.1, Eleveo Call Recording Software)
- [CVE-2026-109082](https://cve.now/CVE-2026-109082.md): Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients (CVSS 6.8, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-108807](https://cve.now/CVE-2026-108807.md): krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql\_query sql injection (CVSS 6.9, krupalshah EmployeeRecruitmentSystem)
- [CVE-2026-108806](https://cve.now/CVE-2026-108806.md): krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql\_query sql injection (CVSS 6.9, krupalshah EmployeeRecruitmentSystem)
- [CVE-2026-107791](https://cve.now/CVE-2026-107791.md): WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav\_delete\_all\_comment (CVSS 6.5, WP Comment Cleaner)
- [CVE-2025-15703](https://cve.now/CVE-2025-15703.md): WP Job Openings \< 4.0.0 - Admin+ Stored XSS (CVSS 3.5, HireZoot)
- [CVE-2026-84166](https://cve.now/CVE-2026-84166.md): Hotel Booking \<= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF (CVSS 4.3, Hotel Booking)
- [CVE-2026-84167](https://cve.now/CVE-2026-84167.md): Hotel Booking \<= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR (CVSS 4.3, Hotel Booking)
- [CVE-2026-98385](https://cve.now/CVE-2026-98385.md): sched/cache: Decouple sched\_cache\_group from mm to fix UAF (CVSS 7.8, Linux)
- [CVE-2026-108805](https://cve.now/CVE-2026-108805.md): krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql\_query sql injection (CVSS 6.9, krupalshah EmployeeRecruitmentSystem)
- [CVE-2026-109080](https://cve.now/CVE-2026-109080.md): SQL injection in Night Shift bulk license plate search allows cross-organization data access (CVSS 7.1, Flock Night Shift)
- [CVE-2026-108804](https://cve.now/CVE-2026-108804.md): TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection (CVSS 10.0, TRENDnet TEW-751DR · TRENDnet TEW-752DRU +1)
- [CVE-2026-108803](https://cve.now/CVE-2026-108803.md): y\_project RuoYi Disable API add changeStatus session expiration (CVSS 5.3, y\_project RuoYi)
- [CVE-2026-107203](https://cve.now/CVE-2026-107203.md): Foreman: domain and subnet interface api skips host search filters (CVSS 5.4, Red Hat Satellite)
- [CVE-2026-107193](https://cve.now/CVE-2026-107193.md): Foreman: api filter lookup ignores a search-limited filter permission (CVSS 6.5, Red Hat Satellite)
- [CVE-2026-108802](https://cve.now/CVE-2026-108802.md): y\_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting (CVSS 5.1, y\_project RuoYi)
- [CVE-2026-21139](https://cve.now/CVE-2026-21139.md): Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the co (CVSS 7.3, Samsung Mobile Samsung Continuity Service for windows)
- [CVE-2026-21138](https://cve.now/CVE-2026-21138.md): Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applic (CVSS 6.9, Samsung Mobile Smart Switch)
- [CVE-2026-21137](https://cve.now/CVE-2026-21137.md): Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. (CVSS 5.1, Samsung Mobile Smart Switch)
- [CVE-2026-21136](https://cve.now/CVE-2026-21136.md): Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. (CVSS 6.8, Samsung Mobile Smart Switch)
- [CVE-2026-21135](https://cve.now/CVE-2026-21135.md): Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. (CVSS 5.9, Samsung Mobile Samsung Internet)
- [CVE-2026-21134](https://cve.now/CVE-2026-21134.md): Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. (CVSS 6.1, Samsung Mobile Samsung Flow)
- [CVE-2026-21133](https://cve.now/CVE-2026-21133.md): Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. (CVSS 5.1, Samsung Mobile Samsung Flow)
- [CVE-2026-21132](https://cve.now/CVE-2026-21132.md): Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. (CVSS 6.0, Samsung Mobile Samsung Internet)
- [CVE-2026-21131](https://cve.now/CVE-2026-21131.md): Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung F (CVSS 2.1, Samsung Mobile Samsung Flow)
- [CVE-2026-21130](https://cve.now/CVE-2026-21130.md): Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an ar (CVSS 5.1, Samsung Mobile Samsung Checkout)
- [CVE-2026-21129](https://cve.now/CVE-2026-21129.md): Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch (CVSS 5.1, Samsung Mobile Samsung Checkout)
- [CVE-2026-21128](https://cve.now/CVE-2026-21128.md): Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbit (CVSS 5.1, Samsung Mobile Samsung Checkout)
- [CVE-2026-21127](https://cve.now/CVE-2026-21127.md): Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive d (CVSS 6.9, Samsung Mobile Samsung Account)
- [CVE-2026-21126](https://cve.now/CVE-2026-21126.md): Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21125](https://cve.now/CVE-2026-21125.md): Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to p (CVSS 8.6, Samsung Mobile Devices)
- [CVE-2026-21124](https://cve.now/CVE-2026-21124.md): Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers (CVSS 8.6, Samsung Mobile Devices)
- [CVE-2026-21123](https://cve.now/CVE-2026-21123.md): Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to acces (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2026-21122](https://cve.now/CVE-2026-21122.md): Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.0, Samsung Mobile Devices)
- [CVE-2026-21121](https://cve.now/CVE-2026-21121.md): Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs. (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21120](https://cve.now/CVE-2026-21120.md): Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privi (CVSS 8.9, Samsung Mobile Devices)
- [CVE-2026-21119](https://cve.now/CVE-2026-21119.md): Out-of-bounds read and write in lib\_sag\_ai\_sound\_sep\_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-o (CVSS 4.8, Samsung Mobile Devices)
- [CVE-2026-21118](https://cve.now/CVE-2026-21118.md): Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage. (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21117](https://cve.now/CVE-2026-21117.md): Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21116](https://cve.now/CVE-2026-21116.md): Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21115](https://cve.now/CVE-2026-21115.md): Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21114](https://cve.now/CVE-2026-21114.md): Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.0, Samsung Mobile Devices)
- [CVE-2026-87690](https://cve.now/CVE-2026-87690.md): Metasploit Framework ios\_image\_gather Path Traversal Leading to Arbitrary File Write and Code Execution (CVSS 8.8, Rapid7 Metasploit Framework)
- [CVE-2026-108801](https://cve.now/CVE-2026-108801.md): prasathmani TinyFileManager tinyfilemanager.php move\_uploaded\_file unrestricted upload (CVSS 5.3, prasathmani TinyFileManager)
- [CVE-2026-108800](https://cve.now/CVE-2026-108800.md): yangzongzhuan RuoYi cross-site request forgery (CVSS 5.3, yangzongzhuan RuoYi)
- [CVE-2026-108799](https://cve.now/CVE-2026-108799.md): jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection (CVSS 6.9, jackq XCMS)
- [CVE-2026-108798](https://cve.now/CVE-2026-108798.md): ZKTeco BioTime hard-coded key (CVSS 6.9, ZKTeco BioTime)
- [CVE-2026-108797](https://cve.now/CVE-2026-108797.md): ZKTeco BioTime Employee REST API employees authorization (CVSS 5.3, ZKTeco BioTime)
- [CVE-2026-108796](https://cve.now/CVE-2026-108796.md): ZKTeco BioTime Biometric Data Endpoint finger\_data authorization (CVSS 5.3, ZKTeco BioTime)
- [CVE-2026-108795](https://cve.now/CVE-2026-108795.md): ZKTeco BioTime System Settings API systemSettings access control (CVSS 5.3, ZKTeco BioTime)
- [CVE-2026-108985](https://cve.now/CVE-2026-108985.md): ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs\_zdr\_bytes(), libnfs\_z (CVSS 7.1, sahlberg libnfs)
- [CVE-2026-108794](https://cve.now/CVE-2026-108794.md): ZKTeco BioTime Database Migration Functionality db\_migrate\_setting sql injection (CVSS 5.3, ZKTeco BioTime)
- [CVE-2026-107437](https://cve.now/CVE-2026-107437.md): Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A (CVSS 6.2, GeoVision GV-E-map Server)
- [CVE-2026-108791](https://cve.now/CVE-2026-108791.md): westboy CicadasCMS Template Management input TemplateController.input path traversal (CVSS 5.3, westboy CicadasCMS)
- [CVE-2026-108982](https://cve.now/CVE-2026-108982.md): VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. (CVSS 7.2, IDRIX VeraCrypt)
- [CVE-2026-108790](https://cve.now/CVE-2026-108790.md): westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal (CVSS 5.1, westboy CicadasCMS)
- [CVE-2026-108981](https://cve.now/CVE-2026-108981.md): ngx\_cache\_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., (CVSS 3.6, denji ngx\_cache\_purge)
- [CVE-2026-108789](https://cve.now/CVE-2026-108789.md): deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow (CVSS 5.1, deepseek-ai deepseek-harness)
- [CVE-2026-108788](https://cve.now/CVE-2026-108788.md): deepseek-ai deepseek-harness Sandbox spawn sandbox (CVSS 4.8, deepseek-ai deepseek-harness)
- [CVE-2026-108980](https://cve.now/CVE-2026-108980.md): Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. (CVSS 8.8, Blinko)
- [CVE-2026-108787](https://cve.now/CVE-2026-108787.md): houtini-ai voice-analyser-mcp collect\_corpus crawler.ts fetch server-side request forgery (CVSS 5.3, houtini-ai voice-analyser-mcp)
- [CVE-2026-108786](https://cve.now/CVE-2026-108786.md): houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run\_seo\_audit server-side request forgery (CVSS 5.3, houtini-ai seo-crawler-mcp)
- [CVE-2026-66086](https://cve.now/CVE-2026-66086.md): Stack-based Buffer Overflow in Modem (CVSS 8.3, Unisoc (Shanghai) Technologies Co. Modem)
- [CVE-2026-66085](https://cve.now/CVE-2026-66085.md): Information Disclosure in Modem (CVSS 5.5, Unisoc (Shanghai) Technologies Co. Modem)
- [CVE-2026-87765](https://cve.now/CVE-2026-87765.md): Improper Input Validation in Kernel APsys DVFS (CVSS 5.5, Unisoc (Shanghai) Technologies Co. kernel)
- [CVE-2026-108785](https://cve.now/CVE-2026-108785.md): macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration (CVSS 5.3, macrozheng mall)
- [CVE-2026-108784](https://cve.now/CVE-2026-108784.md): macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error (CVSS 6.9, macrozheng mall)
- [CVE-2026-108783](https://cve.now/CVE-2026-108783.md): PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials (CVSS 6.9, PRVTPRO Amnezia-Web-Panel)
- [CVE-2026-108782](https://cve.now/CVE-2026-108782.md): erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection (CVSS 5.3, erzhongxmu JEEWMS)
- [CVE-2026-108781](https://cve.now/CVE-2026-108781.md): erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection (CVSS 5.3, erzhongxmu JEEWMS)
- [CVE-2026-108779](https://cve.now/CVE-2026-108779.md): erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection (CVSS 5.3, erzhongxmu JEEWMS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.