# CVEs published 2026-10-14

831 CVEs were published on October 14, 2026: 79 critical, 331 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2026-110809](https://cve.now/CVE-2026-110809.md): sgl-project SGLang Session Cleanup session\_controller.py Session.create\_req denial of service (CVSS 5.3, sgl-project SGLang)
- [CVE-2026-110807](https://cve.now/CVE-2026-110807.md): sgl-project SGLang generate Endpoint io\_struct.py denial of service (CVSS 5.3, sgl-project SGLang)
- [CVE-2026-110873](https://cve.now/CVE-2026-110873.md): Heym 0.0.55 before 0.0.121 Credential Theft via error\_workflow\_id Field (CVSS 7.1, heymrun heym)
- [CVE-2026-110872](https://cve.now/CVE-2026-110872.md): Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing (CVSS 8.2, nodemailer)
- [CVE-2026-110871](https://cve.now/CVE-2026-110871.md): Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service (CVSS 7.1, nodemailer)
- [CVE-2026-110870](https://cve.now/CVE-2026-110870.md): Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments (CVSS 6.9, nodemailer)
- [CVE-2026-110869](https://cve.now/CVE-2026-110869.md): Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes (CVSS 8.7, nodemailer)
- [CVE-2026-110868](https://cve.now/CVE-2026-110868.md): Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources (CVSS 8.4, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-110867](https://cve.now/CVE-2026-110867.md): Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset (CVSS 9.0, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-110866](https://cve.now/CVE-2026-110866.md): Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request (CVSS 5.3, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-110865](https://cve.now/CVE-2026-110865.md): Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets (CVSS 7.1, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-110864](https://cve.now/CVE-2026-110864.md): Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy (CVSS 9.1, better-auth)
- [CVE-2026-110863](https://cve.now/CVE-2026-110863.md): Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers (CVSS 8.6, better-auth sso)
- [CVE-2026-110862](https://cve.now/CVE-2026-110862.md): Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link (CVSS 9.3, better-auth)
- [CVE-2026-110861](https://cve.now/CVE-2026-110861.md): Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition (CVSS 6.3, better-auth drizzle-adapter · better-auth kysely-adapter +3)
- [CVE-2026-110860](https://cve.now/CVE-2026-110860.md): GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() (CVSS 6.9, gitpython-developers GitPython · gitpython)
- [CVE-2026-110859](https://cve.now/CVE-2026-110859.md): GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-110858](https://cve.now/CVE-2026-110858.md): GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVSS 9.2, gitpython-developers GitPython · gitpython)
- [CVE-2026-110857](https://cve.now/CVE-2026-110857.md): GitPython before 3.2.0 Command Execution via ls\_remote ext:: URLs (CVSS 7.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-110856](https://cve.now/CVE-2026-110856.md): GitPython before 3.2.0 ReDoS via \_re\_actor\_epoch in parse\_actor\_and\_date (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-110855](https://cve.now/CVE-2026-110855.md): GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name (CVSS 7.1, gitpython-developers GitPython · gitpython)
- [CVE-2026-110854](https://cve.now/CVE-2026-110854.md): Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error (CVSS 8.2, parse-community parse-server · parse)
- [CVE-2026-110853](https://cve.now/CVE-2026-110853.md): n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON (CVSS 7.1, n8n-io n8n)
- [CVE-2026-110852](https://cve.now/CVE-2026-110852.md): n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution (CVSS 6.3, n8n-io n8n)
- [CVE-2026-110851](https://cve.now/CVE-2026-110851.md): n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint (CVSS 6.1, n8n-io n8n)
- [CVE-2026-110850](https://cve.now/CVE-2026-110850.md): n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters (CVSS 7.2, n8n-io n8n)
- [CVE-2026-110849](https://cve.now/CVE-2026-110849.md): n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview (CVSS 7.2, n8n-io n8n)
- [CVE-2026-110848](https://cve.now/CVE-2026-110848.md): n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge (CVSS 6.0, n8n-io n8n)
- [CVE-2026-110847](https://cve.now/CVE-2026-110847.md): n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter (CVSS 7.0, n8n-io n8n)
- [CVE-2026-110846](https://cve.now/CVE-2026-110846.md): n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook (CVSS 7.0, n8n-io n8n)
- [CVE-2026-110845](https://cve.now/CVE-2026-110845.md): n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation (CVSS 7.7, n8n-io n8n)
- [CVE-2026-110844](https://cve.now/CVE-2026-110844.md): n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows (CVSS 7.2, n8n-io n8n)
- [CVE-2026-110843](https://cve.now/CVE-2026-110843.md): n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint (CVSS 8.2, n8n-io n8n)
- [CVE-2026-110842](https://cve.now/CVE-2026-110842.md): n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter (CVSS 7.7, n8n-io n8n)
- [CVE-2026-110841](https://cve.now/CVE-2026-110841.md): n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval (CVSS 6.1, n8n-io n8n)
- [CVE-2026-110840](https://cve.now/CVE-2026-110840.md): n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field (CVSS 7.0, n8n-io n8n)
- [CVE-2026-110839](https://cve.now/CVE-2026-110839.md): FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data (CVSS 7.1, FreeRDP)
- [CVE-2026-110838](https://cve.now/CVE-2026-110838.md): FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass (CVSS 8.7, FreeRDP)
- [CVE-2026-110837](https://cve.now/CVE-2026-110837.md): FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding (CVSS 6.1, FreeRDP)
- [CVE-2026-110836](https://cve.now/CVE-2026-110836.md): FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type (CVSS 7.1, FreeRDP)
- [CVE-2026-110835](https://cve.now/CVE-2026-110835.md): FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token (CVSS 6.3, FreeRDP)
- [CVE-2026-110834](https://cve.now/CVE-2026-110834.md): FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle (CVSS 7.1, FreeRDP)
- [CVE-2026-110833](https://cve.now/CVE-2026-110833.md): FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy (CVSS 8.2, FreeRDP)
- [CVE-2026-110832](https://cve.now/CVE-2026-110832.md): FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA\_FIRST (CVSS 7.1, FreeRDP)
- [CVE-2026-110831](https://cve.now/CVE-2026-110831.md): FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP\_MJ\_CREATE (CVSS 5.3, FreeRDP)
- [CVE-2026-110830](https://cve.now/CVE-2026-110830.md): FreeRDP before 3.32.0 Denial of Service via Serial IRP\_MJ\_CREATE (CVSS 8.2, FreeRDP)
- [CVE-2026-110829](https://cve.now/CVE-2026-110829.md): FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment (CVSS 7.1, FreeRDP)
- [CVE-2026-107795](https://cve.now/CVE-2026-107795.md): Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API (CVSS 7.5, TP-Link Systems Omada Software Controller)
- [CVE-2026-110816](https://cve.now/CVE-2026-110816.md): qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string (CVSS 5.3, ljharb qs · qs)
- [CVE-2026-102298](https://cve.now/CVE-2026-102298.md): Insufficient Authorization and User Boundary Validation in Omada Controller MSP (CVSS 7.5, TP-Link System Omada Software Controller)
- [CVE-2026-110698](https://cve.now/CVE-2026-110698.md): Praat Model Loader whisper.cpp whisper\_model\_load out-of-bounds write (CVSS 5.3, Praat)
- [CVE-2026-108337](https://cve.now/CVE-2026-108337.md): Password Reset Code Accessible in User Listing API (CVSS 7.4, Hitachi Vantara Remot Ops Agent)
- [CVE-2026-108336](https://cve.now/CVE-2026-108336.md): Token Signing Key Allows Unauthenticated Administrative Access (CVSS 9.1, Hitachi Vantara Remot Ops Agent)
- [CVE-2026-108335](https://cve.now/CVE-2026-108335.md): Password Reset Functionality Missing Brute-Force Protection (CVSS 9.1, Hitachi Vantara Remote Ops Agent)
- [CVE-2026-110696](https://cve.now/CVE-2026-110696.md): itsmeravitejak Online-Examination-System dbtables.sql information disclosure (CVSS 6.9, itsmeravitejak Online-Examination-System)
- [CVE-2026-110695](https://cve.now/CVE-2026-110695.md): turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get\_tensor buffer overflow (CVSS 5.3, turboderp ExLlamaV2)
- [CVE-2026-110694](https://cve.now/CVE-2026-110694.md): OAID Tengine tmfile Model Loader tm2\_serializer.c get\_tm\_file\_model out-of-bounds (CVSS 5.3, OAID Tengine)
- [CVE-2026-110689](https://cve.now/CVE-2026-110689.md): OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism (CVSS 4.8, OpenClaw ClawScan)
- [CVE-2026-104109](https://cve.now/CVE-2026-104109.md): FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root (CVSS 6.8, error311 FileRise)
- [CVE-2026-104107](https://cve.now/CVE-2026-104107.md): FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs (CVSS 6.5, error311 FileRise)
- [CVE-2026-104110](https://cve.now/CVE-2026-104110.md): FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php (CVSS 5.3, error311 FileRise)
- [CVE-2026-104108](https://cve.now/CVE-2026-104108.md): FileRise OIDC login can bind an attacker identity to an existing local account (CVSS 8.1, error311 FileRise)
- [CVE-2026-103977](https://cve.now/CVE-2026-103977.md): FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts (CVSS 8.1, error311 FileRise)
- [CVE-2026-104105](https://cve.now/CVE-2026-104105.md): FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay) (CVSS 6.4, error311 FileRise)
- [CVE-2026-104106](https://cve.now/CVE-2026-104106.md): FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification (CVSS 6.5, error311 FileRise)
- [CVE-2026-103988](https://cve.now/CVE-2026-103988.md): FileRise renameFolder omits destination-parent authorization (CVSS 5.4, error311 FileRise)
- [CVE-2026-69193](https://cve.now/CVE-2026-69193.md): FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying (CVSS 6.5, error311 FileRise)
- [CVE-2026-69191](https://cve.now/CVE-2026-69191.md): FileRise: Login Method Restriction Bypass via Direct API Access (CVSS 5.4, error311 FileRise)
- [CVE-2026-77427](https://cve.now/CVE-2026-77427.md): FileRise: Insecure default cryptographic key fallback in manual installs (CVSS 5.9, error311 FileRise)
- [CVE-2026-69194](https://cve.now/CVE-2026-69194.md): FileRise: Unsanitized footerHtml in Public Site Config (CVSS 4.8, error311 FileRise)
- [CVE-2026-110679](https://cve.now/CVE-2026-110679.md): OpenSIPS rtpproxy rtpproxy\_answer out-of-bounds (CVSS 6.9, OpenSIPS)
- [CVE-2026-0311](https://cve.now/CVE-2026-0311.md): Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (CVSS 1.1, Palo Alto Networks Checkov by Prisma Cloud)
- [CVE-2026-0312](https://cve.now/CVE-2026-0312.md): Checkov by Prisma Cloud: Path Traversal Vulnerabilities (CVSS 4.3, Palo Alto Networks Checkov by Prisma Cloud)
- [CVE-2026-0313](https://cve.now/CVE-2026-0313.md): Cortex XSOAR: OS Command Injection Vulnerability (CVSS 6.1, Palo Alto Networks Cortex XSOAR OS Query · Palo Alto Networ…)
- [CVE-2026-64856](https://cve.now/CVE-2026-64856.md): FileRise: Missing Authentication Guard on File Snippet Preview Endpoint (CVSS 3.7, error311 FileRise)
- [CVE-2026-0314](https://cve.now/CVE-2026-0314.md): GlobalProtect App: Local Denial of Service (DoS) on Windows (CVSS 4.3, Palo Alto Networks GlobalProtect App)
- [CVE-2026-62664](https://cve.now/CVE-2026-62664.md): FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root (CVSS 5.4, error311 FileRise)
- [CVE-2026-0315](https://cve.now/CVE-2026-0315.md): GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (CVSS 5.9, Palo Alto Networks GlobalProtect App)
- [CVE-2026-61844](https://cve.now/CVE-2026-61844.md): FileRise: Folder Metadata Filename Collisions Bypass "read\_own" Isolation (CVSS 7.1, error311 FileRise)
- [CVE-2026-0316](https://cve.now/CVE-2026-0316.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability (CVSS 1.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-61843](https://cve.now/CVE-2026-61843.md): FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares (CVSS 8.2, error311 FileRise)
- [CVE-2026-57493](https://cve.now/CVE-2026-57493.md): FileRise: Remember-me auto-login uses stale admin role from token instead of current role (CVSS 6.8, error311 FileRise)
- [CVE-2026-0317](https://cve.now/CVE-2026-0317.md): PAN-OS: Denial of Service Vulnerability (CVSS 1.2, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-57492](https://cve.now/CVE-2026-57492.md): FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation (CVSS 7.4, error311 FileRise)
- [CVE-2026-57490](https://cve.now/CVE-2026-57490.md): FileRise: WebDAV authentication bypasses TOTP/MFA entirely (CVSS 8.1, error311 FileRise)
- [CVE-2026-0318](https://cve.now/CVE-2026-0318.md): PAN-OS: Denial of Service (DoS) on Panorama (CVSS 4.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-57491](https://cve.now/CVE-2026-57491.md): FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist (CVSS 6.5, error311 FileRise)
- [CVE-2026-57489](https://cve.now/CVE-2026-57489.md): FileRise: AUTH\_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass (CVSS 8.1, error311 FileRise)
- [CVE-2026-0319](https://cve.now/CVE-2026-0319.md): PAN-OS: Improper Input Handling Vulnerability (CVSS 4.9, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-110670](https://cve.now/CVE-2026-110670.md): cemtan sar2html Archive Processing sar2html.py updateDb sql injection (CVSS 6.9, cemtan sar2html)
- [CVE-2026-0320](https://cve.now/CVE-2026-0320.md): PAN-OS: Authenticated Admin Command Injection Vulnerability (CVSS 6.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-100232](https://cve.now/CVE-2026-100232.md): Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi (CVSS 7.2, SonicWall Network Security Manager)
- [CVE-2026-96540](https://cve.now/CVE-2026-96540.md): An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, pot (CVSS 8.8, SonicWall Network Security Manager)
- [CVE-2026-71854](https://cve.now/CVE-2026-71854.md): OpenAEV has unauthenticated access and missing object-level authorization on player lessons API (CVSS 8.2, OpenAEV-Platform openaev)
- [CVE-2026-0321](https://cve.now/CVE-2026-0321.md): PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services (CVSS 6.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-55498](https://cve.now/CVE-2026-55498.md): FileRise Shared Folder Symlink Escape (CVSS 4.8, error311 FileRise)
- [CVE-2026-55684](https://cve.now/CVE-2026-55684.md): WeGIA: SQL Injection in html/socio/sistema/cadastro\_cobrancas\_geracao.php (CVSS 9.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-55682](https://cve.now/CVE-2026-55682.md): WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB\_HOST Leak in html/seguranca/sessionStart.php (CVSS 8.1, LabRedesCefetRJ WeGIA)
- [CVE-2026-110669](https://cve.now/CVE-2026-110669.md): cemtan sar2html sar2html.py deleteAll missing authentication (CVSS 6.9, cemtan sar2html)
- [CVE-2026-55681](https://cve.now/CVE-2026-55681.md): WeGIA: SQL Injection in html/matPat/restaurar\_produto\_desocultar.php via id\_produto parameter (CVSS 8.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-55679](https://cve.now/CVE-2026-55679.md): WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection (CVSS 6.5, LabRedesCefetRJ WeGIA)
- [CVE-2026-55680](https://cve.now/CVE-2026-55680.md): WeGIA: Unauthenticated SQL Injection in cadastro\_cobranca.php via "codigo" parameter (CVSS 9.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-55683](https://cve.now/CVE-2026-55683.md): WeGIA: SQL Injection in html/socio/sistema/cadastro\_cobranca.php (CVSS 9.8, LabRedesCefetRJ WeGIA)
- [CVE-2026-110310](https://cve.now/CVE-2026-110310.md): RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET (CVSS 5.3, Amazon.Extensions.S3.Encryption)
- [CVE-2026-102980](https://cve.now/CVE-2026-102980.md): Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope (CVSS 6.5, makeplane plane)
- [CVE-2026-102985](https://cve.now/CVE-2026-102985.md): Plane: Any project member can modify (deactivate) other members' records (CVSS 6.5, makeplane plane)
- [CVE-2026-110668](https://cve.now/CVE-2026-110668.md): cemtan sar2html sar2html.py index sql injection (CVSS 6.9, cemtan sar2html)
- [CVE-2026-102986](https://cve.now/CVE-2026-102986.md): Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/ (CVSS 8.1, makeplane plane)
- [CVE-2026-55382](https://cve.now/CVE-2026-55382.md): InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR) (CVSS 7.6, InvoiceShelf)
- [CVE-2026-55385](https://cve.now/CVE-2026-55385.md): InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration (CVSS 6.8, InvoiceShelf)
- [CVE-2026-55381](https://cve.now/CVE-2026-55381.md): InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates (CVSS 7.1, InvoiceShelf)
- [CVE-2026-55383](https://cve.now/CVE-2026-55383.md): InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure (CVSS 8.2, InvoiceShelf)
- [CVE-2026-55387](https://cve.now/CVE-2026-55387.md): InvoiceShelf bulk deletion lacks company scoping (CVSS 7.2, InvoiceShelf)
- [CVE-2026-55386](https://cve.now/CVE-2026-55386.md): InvoiceShelf ORDER BY SQL injection through orderByField (CVSS 7.1, InvoiceShelf)
- [CVE-2026-55384](https://cve.now/CVE-2026-55384.md): InvoiceShelf trusts client-supplied document totals (CVSS 5.3, InvoiceShelf)
- [CVE-2026-54702](https://cve.now/CVE-2026-54702.md): Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler (CVSS 7.3, shd101wyy vscode-markdown-preview-enhanced)
- [CVE-2026-54701](https://cve.now/CVE-2026-54701.md): Markdown Preview Enhanced: Stored XSS via Unsanitized \`.crossnote/head.html\` Injection in Webview (CVSS 6.9, shd101wyy vscode-markdown-preview-enhanced)
- [CVE-2026-54703](https://cve.now/CVE-2026-54703.md): Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation (CVSS 5.8, shd101wyy vscode-markdown-preview-enhanced)
- [CVE-2026-54566](https://cve.now/CVE-2026-54566.md): Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in \`.crossnote/config.js\` and \`.crossnote/parser.js\` (CVSS 8.5, shd101wyy vscode-markdown-preview-enhanced)
- [CVE-2026-54525](https://cve.now/CVE-2026-54525.md): Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows (CVSS 8.8, shd101wyy vscode-markdown-preview-enhanced)
- [CVE-2026-110667](https://cve.now/CVE-2026-110667.md): cemtan sar2html sar2html.py hard-coded credentials (CVSS 6.9, cemtan sar2html)
- [CVE-2026-102354](https://cve.now/CVE-2026-102354.md): BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker (CVSS 6.8, alam00000 bentopdf)
- [CVE-2026-102899](https://cve.now/CVE-2026-102899.md): Sentry: Improper authentication on SAML SSO process allows user identity linking (CVSS 7.6, getsentry sentry)
- [CVE-2026-102471](https://cve.now/CVE-2026-102471.md): CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages (CVSS 6.9, Eclipse Foundation Eclipse Vert.x)
- [CVE-2026-82402](https://cve.now/CVE-2026-82402.md): Gogs: Open Redirect in /redirect endpoint via backslash bypass in \`IsSameSite\` (CVSS 5.3, gogs)
- [CVE-2026-110775](https://cve.now/CVE-2026-110775.md): Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check\_file\_access (CVSS 7.1, ModelEngine-Group nexent)
- [CVE-2026-110774](https://cve.now/CVE-2026-110774.md): Blinko through 1.8.8 Private Attachment Read via /api/file Route (CVSS 6.0, blinkospace blinko)
- [CVE-2026-110773](https://cve.now/CVE-2026-110773.md): GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint (CVSS 5.3, growchief)
- [CVE-2026-110772](https://cve.now/CVE-2026-110772.md): Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update (CVSS 5.3, we-promise sure)
- [CVE-2026-110771](https://cve.now/CVE-2026-110771.md): Shopizer through 3.2.5 Authorization Bypass via Product Review customerId (CVSS 5.3, Shopizer)
- [CVE-2026-110770](https://cve.now/CVE-2026-110770.md): Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force (CVSS 9.2, databasus)
- [CVE-2026-110769](https://cve.now/CVE-2026-110769.md): holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors (CVSS 8.3, holaboss-ai holaOS)
- [CVE-2026-110768](https://cve.now/CVE-2026-110768.md): holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist (CVSS 6.3, holaboss-ai holaOS)
- [CVE-2026-110767](https://cve.now/CVE-2026-110767.md): Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion (CVSS 8.7, coderamp-labs gitingest)
- [CVE-2026-110766](https://cve.now/CVE-2026-110766.md): Colanode Server through 0.4.7 Path Traversal via Avatar Download Route (CVSS 5.3, colanode)
- [CVE-2026-110765](https://cve.now/CVE-2026-110765.md): FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass (CVSS 8.2, flexprice)
- [CVE-2026-110764](https://cve.now/CVE-2026-110764.md): AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download (CVSS 6.0, iflytek astron-rpa)
- [CVE-2026-110763](https://cve.now/CVE-2026-110763.md): lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany (CVSS 5.3, zuihou lamp-boot)
- [CVE-2026-110762](https://cve.now/CVE-2026-110762.md): bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream (CVSS 6.3, bbPress)
- [CVE-2026-110761](https://cve.now/CVE-2026-110761.md): ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import (CVSS 8.7, ILIAS-eLearning e.V. ILIAS)
- [CVE-2026-102755](https://cve.now/CVE-2026-102755.md): DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting (CVSS 5.1, dataease)
- [CVE-2026-110666](https://cve.now/CVE-2026-110666.md): cemtan sar2html File Upload sar2html.py updateDb path traversal (CVSS 6.9, cemtan sar2html)
- [CVE-2026-102756](https://cve.now/CVE-2026-102756.md): DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting (CVSS 5.1, dataease)
- [CVE-2026-102479](https://cve.now/CVE-2026-102479.md): In Eclipse Vert.x versions \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Vert.x HTTP/1.x decoder uses a canonicalization for well k (CVSS 8.7, Eclipse Foundation Eclipse Vert.x)
- [CVE-2026-104143](https://cve.now/CVE-2026-104143.md): DataEase: Stored SQL Injection via dateFormat field templates (CVSS 8.7, dataease)
- [CVE-2026-104142](https://cve.now/CVE-2026-104142.md): DataEase: Stored SQL Injection in group-field binning bounds (CVSS 8.7, dataease)
- [CVE-2026-104141](https://cve.now/CVE-2026-104141.md): DataEase: SQL Injection in datasource metadata identifiers (CVSS 8.7, dataease)
- [CVE-2026-82153](https://cve.now/CVE-2026-82153.md): Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. (CVSS 2.2, Dell OS Recovery Tool)
- [CVE-2026-53999](https://cve.now/CVE-2026-53999.md): Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) (CVSS 7.7, radius-project radius · github.com/radius-project/radius)
- [CVE-2026-102460](https://cve.now/CVE-2026-102460.md): In Eclipse Vert.x versions \[4.0.0, 4.5.34\] or \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], a scope bypass vulnerability exists in Ecli (CVSS 8.6, Eclipse Foundation Eclipse Vert.x)
- [CVE-2026-110248](https://cve.now/CVE-2026-110248.md): Insertion of sensitive information into log files in Amazon SageMaker Python SDK git\_utils\[.\]py (CVSS 5.3, AWS SageMaker Python SDK)
- [CVE-2026-102748](https://cve.now/CVE-2026-102748.md): Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service (CVSS 9.2, dgraph-io dgraph · github.com/dgraph-io/dgraph/v25)
- [CVE-2026-109506](https://cve.now/CVE-2026-109506.md): Improper Authentication in Multiple TP-Link WiFi Repeaters (CVSS 5.9, TP-Link Systems RE190 · TP-Link Systems RE200 +13)
- [CVE-2026-102682](https://cve.now/CVE-2026-102682.md): Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation (CVSS 5.6, pipecat-ai pipecat · pipecat-ai)
- [CVE-2026-100406](https://cve.now/CVE-2026-100406.md): dbt: Unauthenticated Arbitrary SQL Execution in \`dbt docs serve\` (CVSS 8.2, dbt-labs dbt-core)
- [CVE-2026-63626](https://cve.now/CVE-2026-63626.md): Mongoose: ppp\_handle\_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG\_ENABLE\_IPV6) (CVSS 8.8, cesanta mongoose)
- [CVE-2026-73261](https://cve.now/CVE-2026-73261.md): Mongoose: handle\_opt() missing opts\[1\] \> len check — 1-byte OOB read corrupts TCP MSS, silences mg\_send() per connection (CVSS 7.5, cesanta mongoose)
- [CVE-2026-73260](https://cve.now/CVE-2026-73260.md): Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser (CVSS 7.5, cesanta mongoose)
- [CVE-2026-73252](https://cve.now/CVE-2026-73252.md): Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg\_tls\_recv\_record() underflows recv\_len to SIZE\_MAX (CVSS 7.5, cesanta mongoose)
- [CVE-2026-55167](https://cve.now/CVE-2026-55167.md): LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session (CVSS 4.2, LDAPAccountManager lam)
- [CVE-2026-85714](https://cve.now/CVE-2026-85714.md): Stirling-PDF: Remote Code Execution via H2 (CVSS 9.1, Stirling-Tools Stirling-PDF)
- [CVE-2026-103930](https://cve.now/CVE-2026-103930.md): cpp-httplib open\_stream serializes CRLF in request target into HTTP request line (CVSS 3.7, yhirose cpp-httplib)
- [CVE-2026-102944](https://cve.now/CVE-2026-102944.md): cpp-httplib: Cookie header leaked on cross-origin redirect (CVSS 7.5, yhirose cpp-httplib)
- [CVE-2026-103974](https://cve.now/CVE-2026-103974.md): lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies (CVSS 5.4, lichess-org lila)
- [CVE-2026-110536](https://cve.now/CVE-2026-110536.md): D-Link DIR-868L HNAP CGI cgibin system os command injection (CVSS 10.0, D-Link DIR-868L)
- [CVE-2026-55786](https://cve.now/CVE-2026-55786.md): Flyto2 Core: Unauthenticated Command Execution via HTTP MCP \`execute\_module\` (CVSS 8.4, flytohub flyto-core · flyto-core)
- [CVE-2026-55787](https://cve.now/CVE-2026-55787.md): Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate\_url\_ssrf (CVSS 7.1, flytohub flyto-core · flyto-core)
- [CVE-2026-55573](https://cve.now/CVE-2026-55573.md): e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain (CVSS 9.8, e107inc e107)
- [CVE-2026-55572](https://cve.now/CVE-2026-55572.md): e107: SQL injection in alt\_auth plugin (otherdb / e107db backends) via login username (CVSS 10.0, e107inc e107)
- [CVE-2026-102476](https://cve.now/CVE-2026-102476.md): In Eclipse Vert.x versions \[5.0.0,5.0.12\] or \[5.1.0,5.1.9\] or \[5.2.0, 5.2.0\], the Vert.x HTTP client relies on an SSL context for efficiency (CVSS 9.1, Eclipse Foundation Eclipse Vert.x)
- [CVE-2026-103975](https://cve.now/CVE-2026-103975.md): Appium: Symlink based Zip Slip in @appium/support ZIP extraction (CVSS 6.5, appium · @appium/support)
- [CVE-2026-108480](https://cve.now/CVE-2026-108480.md): WordPress Skydropx plugin \<= 2.1.4 - Broken Access Control vulnerability (CVSS 8.2, Skydropx)
- [CVE-2026-108484](https://cve.now/CVE-2026-108484.md): WordPress Best Payments Plugin for WP plugin \<= 4.6.27 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPManageNinja Best Payments Plugin for WP)
- [CVE-2026-108483](https://cve.now/CVE-2026-108483.md): WordPress Hippoo Mobile App for WooCommerce plugin \<= 1.12.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hippooo Hippoo Mobile App for WooCommerce)
- [CVE-2026-105066](https://cve.now/CVE-2026-105066.md): WordPress SimplyRETS Real Estate IDX plugin \<= 3.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SimplyRETS Real Estate IDX)
- [CVE-2026-108151](https://cve.now/CVE-2026-108151.md): WordPress MDTF plugin \<= 1.3.9 - Arbitrary Code Execution vulnerability (CVSS 5.3, PluginUs.Net MDTF)
- [CVE-2026-103081](https://cve.now/CVE-2026-103081.md): WordPress Salevo plugin \<= 1.3.0 - Content Injection vulnerability (CVSS 7.5, VillaTheme Salevo)
- [CVE-2026-104103](https://cve.now/CVE-2026-104103.md): Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members (CVSS 8.1, ludwig-ai ludwig)
- [CVE-2026-110777](https://cve.now/CVE-2026-110777.md): Evolution-data-server: local file disclosure via attach file:// uris (CVSS 5.7, GNOME evolution-data-server · Red Hat Enterprise Linux)
- [CVE-2026-54554](https://cve.now/CVE-2026-54554.md): FOG adInfo endpoint is reported to disclose the Active Directory join password (CVSS 7.5, fogproject)
- [CVE-2026-100413](https://cve.now/CVE-2026-100413.md): SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments (CVSS 7.0, seaweedfs)
- [CVE-2026-77371](https://cve.now/CVE-2026-77371.md): Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access (CVSS 9.3, getredash redash)
- [CVE-2026-79957](https://cve.now/CVE-2026-79957.md): ServiceNext Insecure Direct Object Reference via GetUsarios (CVSS 8.1, ServiceNext SerTec)
- [CVE-2026-76083](https://cve.now/CVE-2026-76083.md): Redash: JSON data source query URL can bypass base URL restriction (CVSS 4.9, getredash redash)
- [CVE-2026-42093](https://cve.now/CVE-2026-42093.md): Redash: SQL Injection via Query Results parameterized query substitution (CVSS 8.7, getredash redash)
- [CVE-2026-109527](https://cve.now/CVE-2026-109527.md): Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies (CVSS 7.5, modelcontextprotocol python-sdk)
- [CVE-2026-86849](https://cve.now/CVE-2026-86849.md): Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVSS 6.5, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86856](https://cve.now/CVE-2026-86856.md): Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver (CVSS 6.5, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86847](https://cve.now/CVE-2026-86847.md): Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVSS 6.5, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86846](https://cve.now/CVE-2026-86846.md): Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVSS 6.5, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86845](https://cve.now/CVE-2026-86845.md): Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVSS 6.5, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86566](https://cve.now/CVE-2026-86566.md): Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) (CVSS 6.5, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86848](https://cve.now/CVE-2026-86848.md): Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVSS 8.8, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-88164](https://cve.now/CVE-2026-88164.md): Microsoft Office SharePoint Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Server Subscription Edition)
- [CVE-2026-86567](https://cve.now/CVE-2026-86567.md): Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap (CVSS 8.8, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-106465](https://cve.now/CVE-2026-106465.md): The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. (CVSS 8.7, Eclipse Foundation NetX Duo)
- [CVE-2026-108395](https://cve.now/CVE-2026-108395.md): Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies (CVSS 7.5, io.modelcontextprotocol.sdk:mcp · io.modelcontextprotocol.s…)
- [CVE-2026-106464](https://cve.now/CVE-2026-106464.md): \`\_nx\_secure\_x509\_parse\_signature\_data\` computes the certificate signature's length as \`tlv\_length - 1\` without first checking that \`tlv\_leng (CVSS 8.7, Eclipse Foundation NetX Duo)
- [CVE-2026-103415](https://cve.now/CVE-2026-103415.md): When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the coo (CVSS 9.3, Eclipse Foundation NetX Duo)
- [CVE-2026-107350](https://cve.now/CVE-2026-107350.md): Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer (CVSS 8.8, PgBouncer)
- [CVE-2026-107349](https://cve.now/CVE-2026-107349.md): Infinite loop on empty option name in startup options parameter in PgBouncer (CVSS 7.5, PgBouncer)
- [CVE-2026-107348](https://cve.now/CVE-2026-107348.md): Integer overflow causes an infinite loop in message buffer growth in PgBouncer (CVSS 5.9, PgBouncer)
- [CVE-2026-103414](https://cve.now/CVE-2026-103414.md): The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with indepen (CVSS 8.4, Eclipse Foundation GUIX)
- [CVE-2026-86461](https://cve.now/CVE-2026-86461.md): FV Flowplayer Video Player \<= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video\_url' Parameter (CVSS 8.8, foliovision FV Flowplayer Video Player)
- [CVE-2026-0322](https://cve.now/CVE-2026-0322.md): PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (CVSS 8.6, KEV, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-101954](https://cve.now/CVE-2026-101954.md): Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-101952](https://cve.now/CVE-2026-101952.md): Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101949](https://cve.now/CVE-2026-101949.md): Junos OS and Junos OS Evolved: In a scenario with VPN-flowspec and BMP monitoring a specific BGP update causes an rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-92160](https://cve.now/CVE-2026-92160.md): F´: SendPartial Integer Overflow Leading to Assertion DoS (CVSS 6.5, nasa fprime)
- [CVE-2026-101964](https://cve.now/CVE-2026-101964.md): Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a crafted LDP message (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101963](https://cve.now/CVE-2026-101963.md): Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101962](https://cve.now/CVE-2026-101962.md): Junos OS and Junos OS Evolved: An attacker sending a malformed update causes an rpd crash when BGP EVPN signaling is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-92155](https://cve.now/CVE-2026-92155.md): F´: FileUplink Unknown Packet Type Assertion DoS (CVSS 7.5, nasa fprime)
- [CVE-2026-101961](https://cve.now/CVE-2026-101961.md): Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when an ECMP qualifier is used in an import policy (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101959](https://cve.now/CVE-2026-101959.md): Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-92150](https://cve.now/CVE-2026-92150.md): F´: GenericHub Malformed Buffer Assertion DoS (CVSS 7.5, nasa fprime)
- [CVE-2026-101983](https://cve.now/CVE-2026-101983.md): Junos OS and Junos OS Evolved: An attacker causes remote code execution when J-Web virtual-domain is configured (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-108390](https://cve.now/CVE-2026-108390.md): HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking (CVSS 9.9, hestiacp)
- [CVE-2026-92154](https://cve.now/CVE-2026-92154.md): F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation (CVSS 8.1, nasa fprime)
- [CVE-2026-101982](https://cve.now/CVE-2026-101982.md): Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-101981](https://cve.now/CVE-2026-101981.md): Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-101979](https://cve.now/CVE-2026-101979.md): Junos OS and Junos OS Evolved: A network attacker causes root-level code execution or denial of service when SNMP and AAA are enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-101976](https://cve.now/CVE-2026-101976.md): Junos OS and Junos OS Evolved: In a non-4byte-AS scenario a specific BGP update causes an rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101975](https://cve.now/CVE-2026-101975.md): Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd crash when prefix-SID best-route installation is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101972](https://cve.now/CVE-2026-101972.md): Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disruption when OSPF is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-92158](https://cve.now/CVE-2026-92158.md): F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write (CVSS 7.2, nasa fprime)
- [CVE-2026-102077](https://cve.now/CVE-2026-102077.md): Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets will lead to resource leaks and eventually traffic stops (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-92159](https://cve.now/CVE-2026-92159.md): F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry (CVSS 6.5, nasa fprime)
- [CVE-2026-92156](https://cve.now/CVE-2026-92156.md): F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge (CVSS 6.5, nasa fprime)
- [CVE-2026-92157](https://cve.now/CVE-2026-92157.md): F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion (CVSS 6.5, nasa fprime)
- [CVE-2026-92152](https://cve.now/CVE-2026-92152.md): F´: Unvalidated Port Index in GenericHub (CVSS 9.3, nasa fprime)
- [CVE-2026-33798](https://cve.now/CVE-2026-33798.md): Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-33796](https://cve.now/CVE-2026-33796.md): Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-33795](https://cve.now/CVE-2026-33795.md): Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-33792](https://cve.now/CVE-2026-33792.md): Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-33789](https://cve.now/CVE-2026-33789.md): Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-102185](https://cve.now/CVE-2026-102185.md): Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when EVPN multihoming preference-based DF election is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102184](https://cve.now/CVE-2026-102184.md): Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102183](https://cve.now/CVE-2026-102183.md): Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102182](https://cve.now/CVE-2026-102182.md): Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-102180](https://cve.now/CVE-2026-102180.md): Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102179](https://cve.now/CVE-2026-102179.md): Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102178](https://cve.now/CVE-2026-102178.md): Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-102177](https://cve.now/CVE-2026-102177.md): Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used (CVSS 7.6, Juniper Networks Junos OS)
- [CVE-2026-102176](https://cve.now/CVE-2026-102176.md): Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102175](https://cve.now/CVE-2026-102175.md): Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-96596](https://cve.now/CVE-2026-96596.md): erl\_tar:extract/2 loops forever on a GNU sparse member with a trailing hole (CVSS 5.9, erlang rebar3 · hexpm hex\_core +3)
- [CVE-2026-102174](https://cve.now/CVE-2026-102174.md): Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102061](https://cve.now/CVE-2026-102061.md): Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-105236](https://cve.now/CVE-2026-105236.md): TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries (CVSS 6.3, Erlang OTP)
- [CVE-2026-102060](https://cve.now/CVE-2026-102060.md): Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a routing daemon crash when multicast lawful intercept is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102059](https://cve.now/CVE-2026-102059.md): Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-94200](https://cve.now/CVE-2026-94200.md): TLS 1.3 client ticket store crashed by NewSessionTicket with empty early\_data extension in ssl (CVSS 8.2, Erlang OTP)
- [CVE-2026-102058](https://cve.now/CVE-2026-102058.md): Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service when BFD is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102057](https://cve.now/CVE-2026-102057.md): Junos OS: An attacker causes DHCP service disruption during DHCP client operation (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102056](https://cve.now/CVE-2026-102056.md): Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled (CVSS 7.1, Juniper Networks Junos OS)
- [CVE-2026-105659](https://cve.now/CVE-2026-105659.md): HTTP/2 blocked-send deadlines reset on every WINDOW\_UPDATE, letting a trickle pin stream processes indefinitely in Bandit (CVSS 8.7, mtrudel bandit · bandit)
- [CVE-2026-102055](https://cve.now/CVE-2026-102055.md): Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102054](https://cve.now/CVE-2026-102054.md): Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured (CVSS 4.3, Juniper Networks Junos OS)
- [CVE-2026-102053](https://cve.now/CVE-2026-102053.md): Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2026-102052](https://cve.now/CVE-2026-102052.md): Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102051](https://cve.now/CVE-2026-102051.md): Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102050](https://cve.now/CVE-2026-102050.md): Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102049](https://cve.now/CVE-2026-102049.md): Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102048](https://cve.now/CVE-2026-102048.md): Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102047](https://cve.now/CVE-2026-102047.md): Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102046](https://cve.now/CVE-2026-102046.md): Junos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102045](https://cve.now/CVE-2026-102045.md): Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is enabled (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-102044](https://cve.now/CVE-2026-102044.md): Junos OS and Junos OS Evolved: An attacker causes a routing control-plane denial of service when BGP-LS traffic engineering is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102043](https://cve.now/CVE-2026-102043.md): Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when MPLS-TE fast reroute is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102042](https://cve.now/CVE-2026-102042.md): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP associated-bidirectional LSP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102041](https://cve.now/CVE-2026-102041.md): Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when RSVP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102040](https://cve.now/CVE-2026-102040.md): Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co-routed bidirectional RSVP LSPs are used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102039](https://cve.now/CVE-2026-102039.md): Junos OS and Junos OS Evolved: An attacker causes routing-process denial of service when GMPLS EVPL dynamic transport is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102037](https://cve.now/CVE-2026-102037.md): Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used (CVSS 8.1, Juniper Networks Junos OS)
- [CVE-2026-102036](https://cve.now/CVE-2026-102036.md): Junos OS and Junos OS Evolved: An EVPN default-gateway route burst causes l2ald denial of service (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102035](https://cve.now/CVE-2026-102035.md): Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102034](https://cve.now/CVE-2026-102034.md): Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102033](https://cve.now/CVE-2026-102033.md): Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102032](https://cve.now/CVE-2026-102032.md): Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102031](https://cve.now/CVE-2026-102031.md): Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled (CVSS 9.8, Juniper Networks Junos OS Evolved)
- [CVE-2026-102030](https://cve.now/CVE-2026-102030.md): Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102029](https://cve.now/CVE-2026-102029.md): Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102028](https://cve.now/CVE-2026-102028.md): Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102027](https://cve.now/CVE-2026-102027.md): Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102026](https://cve.now/CVE-2026-102026.md): Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102025](https://cve.now/CVE-2026-102025.md): Junos OS and Junos OS Evolved: A BGP route-processing error causes rpd crash when extended next-hop tunneling and SRv6 service processing are used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102024](https://cve.now/CVE-2026-102024.md): Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP extended-nexthop-tunnel is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102023](https://cve.now/CVE-2026-102023.md): Junos OS Evolved: An attacker causes denial of service via SNMP when firewall counters are used (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-102022](https://cve.now/CVE-2026-102022.md): Junos OS and Junos OS Evolved: An attacker causes a routing-process crash when BGP-LS traffic-engineering is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102021](https://cve.now/CVE-2026-102021.md): Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102020](https://cve.now/CVE-2026-102020.md): Junos OS and Junos OS Evolved: An attacker causes an rpd denial of service when BGP-LS TED export is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102019](https://cve.now/CVE-2026-102019.md): Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102018](https://cve.now/CVE-2026-102018.md): Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-75085](https://cve.now/CVE-2026-75085.md): Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver (CVSS 4.2, zephyrproject zephyr)
- [CVE-2026-75084](https://cve.now/CVE-2026-75084.md): Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length (CVSS 6.8, zephyrproject zephyr)
- [CVE-2026-19673](https://cve.now/CVE-2026-19673.md): Out-of-bounds read and net\_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header (CVSS 7.1, zephyrproject zephyr)
- [CVE-2026-75083](https://cve.now/CVE-2026-75083.md): Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-102017](https://cve.now/CVE-2026-102017.md): Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-109439](https://cve.now/CVE-2026-109439.md): Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718 (CVSS 9.3, LANTRONIX XPress-DR · LANTRONIX XPress-DR-I)
- [CVE-2026-102016](https://cve.now/CVE-2026-102016.md): Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102015](https://cve.now/CVE-2026-102015.md): Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102014](https://cve.now/CVE-2026-102014.md): Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102013](https://cve.now/CVE-2026-102013.md): Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used (CVSS 4.4, Juniper Networks Junos OS)
- [CVE-2026-102012](https://cve.now/CVE-2026-102012.md): Junos OS Evolved: An attacker causes na-grpcd to crash when gRPC telemetry is enabled (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-102011](https://cve.now/CVE-2026-102011.md): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102000](https://cve.now/CVE-2026-102000.md): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101999](https://cve.now/CVE-2026-101999.md): Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101971](https://cve.now/CVE-2026-101971.md): Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101970](https://cve.now/CVE-2026-101970.md): Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101969](https://cve.now/CVE-2026-101969.md): Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial of service when IPv6 PIM is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101968](https://cve.now/CVE-2026-101968.md): Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled (CVSS 5.4, Juniper Networks Junos OS)
- [CVE-2026-101946](https://cve.now/CVE-2026-101946.md): Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used (CVSS 3.5, Juniper Networks Junos OS)
- [CVE-2026-101945](https://cve.now/CVE-2026-101945.md): Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101944](https://cve.now/CVE-2026-101944.md): Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101943](https://cve.now/CVE-2026-101943.md): Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101942](https://cve.now/CVE-2026-101942.md): Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101941](https://cve.now/CVE-2026-101941.md): Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101940](https://cve.now/CVE-2026-101940.md): Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101939](https://cve.now/CVE-2026-101939.md): Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101938](https://cve.now/CVE-2026-101938.md): Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-plane outage when SVR vector routing is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101937](https://cve.now/CVE-2026-101937.md): Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101936](https://cve.now/CVE-2026-101936.md): Junos OS: SRX Series: An attacker causes data-plane denial of service when chassis-cluster high availability is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101934](https://cve.now/CVE-2026-101934.md): Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd (CVSS 4.4, Juniper Networks Junos OS)
- [CVE-2026-101927](https://cve.now/CVE-2026-101927.md): Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2026-101984](https://cve.now/CVE-2026-101984.md): Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-unicast aggregate-label is configured (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-100236](https://cve.now/CVE-2026-100236.md): Dpdk: dpdk: heap out-of-bounds read/write in gso header copy (CVSS 8.6, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-101987](https://cve.now/CVE-2026-101987.md): Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101988](https://cve.now/CVE-2026-101988.md): Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an rpd crash when LDP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101989](https://cve.now/CVE-2026-101989.md): Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash when LDP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101990](https://cve.now/CVE-2026-101990.md): Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-101992](https://cve.now/CVE-2026-101992.md): Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic VPLS site ID is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101993](https://cve.now/CVE-2026-101993.md): Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS automatic site-ID collision resolution is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101994](https://cve.now/CVE-2026-101994.md): Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash (CVSS 7.1, Juniper Networks Junos OS)
- [CVE-2026-101996](https://cve.now/CVE-2026-101996.md): Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2ald crash when MC-LAG is configured (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2016-15060](https://cve.now/CVE-2016-15060.md): PCMan FTP Server PORT buffer overflow (CVSS 6.9, PCMan FTP Server)
- [CVE-2026-102064](https://cve.now/CVE-2026-102064.md): Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102066](https://cve.now/CVE-2026-102066.md): Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-15102](https://cve.now/CVE-2026-15102.md): Cleartext Transmission of Sensitive Information in ADP Desktop SDK (CVSS 7.5, Autodesk ADP Desktop SDK)
- [CVE-2026-102071](https://cve.now/CVE-2026-102071.md): Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when associated bidirectional LSP is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101950](https://cve.now/CVE-2026-101950.md): Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-101955](https://cve.now/CVE-2026-101955.md): Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used (CVSS 8.1, Juniper Networks Junos OS)
- [CVE-2026-101997](https://cve.now/CVE-2026-101997.md): Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication (CVSS 8.1, Juniper Networks Junos OS)
- [CVE-2026-92153](https://cve.now/CVE-2026-92153.md): F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath (CVSS 7.1, nasa fprime)
- [CVE-2026-102062](https://cve.now/CVE-2026-102062.md): Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used (CVSS 8.1, Juniper Networks Junos OS)
- [CVE-2026-102078](https://cve.now/CVE-2026-102078.md): Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flowd crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2026-102079](https://cve.now/CVE-2026-102079.md): Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2026-102080](https://cve.now/CVE-2026-102080.md): Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchover (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2026-102081](https://cve.now/CVE-2026-102081.md): Junos OS: SRX4000 Series, SRX5000 Series and MX Series with SPC3: With application services configured, high session churn causes memory leak which will ultimately impact traffic (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-92151](https://cve.now/CVE-2026-92151.md): F´: SpacePacketDeframer Small Packet Assertion DoS (CVSS 7.5, nasa fprime)
- [CVE-2026-102082](https://cve.now/CVE-2026-102082.md): Junos OS: SRX Series: If TLS session resumption is configured and a specific TLS message is received a PFE crash occurs (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2026-93637](https://cve.now/CVE-2026-93637.md): Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting (CVSS 3.7, Zimbra Collaboration Suite)
- [CVE-2026-102083](https://cve.now/CVE-2026-102083.md): Junos OS: SRX Series: With WebFiltering enabled prolonged HTTP session load can cause a crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2026-102084](https://cve.now/CVE-2026-102084.md): Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution (CVSS 8.1, Juniper Networks Junos OS)
- [CVE-2026-93635](https://cve.now/CVE-2026-93635.md): Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution (CVSS 5.3, Zimbra Collaboration Suite)
- [CVE-2026-102085](https://cve.now/CVE-2026-102085.md): Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-102086](https://cve.now/CVE-2026-102086.md): Junos OS: SRX Series: Multiple DNS queries processed by SecIntel and DGA in the same session cause a flowd crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2026-102087](https://cve.now/CVE-2026-102087.md): Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-103993](https://cve.now/CVE-2026-103993.md): Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes (CVSS 6.8, Juniper Networks Junos OS)
- [CVE-2026-59951](https://cve.now/CVE-2026-59951.md): MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion (CVSS 6.9, modelcontextprotocol python-sdk · mcp)
- [CVE-2026-101991](https://cve.now/CVE-2026-101991.md): Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled (CVSS 3.1, Juniper Networks Junos OS)
- [CVE-2026-101986](https://cve.now/CVE-2026-101986.md): Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-101951](https://cve.now/CVE-2026-101951.md): Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101957](https://cve.now/CVE-2026-101957.md): Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102065](https://cve.now/CVE-2026-102065.md): Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101974](https://cve.now/CVE-2026-101974.md): Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-102067](https://cve.now/CVE-2026-102067.md): Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101995](https://cve.now/CVE-2026-101995.md): Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption (CVSS 4.3, Juniper Networks Junos OS)
- [CVE-2026-101948](https://cve.now/CVE-2026-101948.md): Junos OS and Junos OS Evolved: A specific BGP FlowSpec update causes an rpd crash when BGP FlowSpec import policy is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101977](https://cve.now/CVE-2026-101977.md): Junos OS and Junos OS Evolved: A specific BGP packet causes an rpd crash when ephemeral configuration is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-103946](https://cve.now/CVE-2026-103946.md): SQL Injection (CVSS 8.3, Tenable Nessus)
- [CVE-2026-101956](https://cve.now/CVE-2026-101956.md): Junos OS: Unauthorized root command execution when J-Web is enabled (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-101980](https://cve.now/CVE-2026-101980.md): Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2026-102069](https://cve.now/CVE-2026-102069.md): Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is enabled (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102070](https://cve.now/CVE-2026-102070.md): Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-101973](https://cve.now/CVE-2026-101973.md): Junos OS: Malformed packet causes pkid denial of service when certificate re-enrollment is used (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-102072](https://cve.now/CVE-2026-102072.md): Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-103994](https://cve.now/CVE-2026-103994.md): Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2026-102063](https://cve.now/CVE-2026-102063.md): Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash when HFRR link protection is used (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-101965](https://cve.now/CVE-2026-101965.md): Junos OS Evolved: An attacker causes telemetry disruption when network analytics telemetry is enabled (CVSS 8.8, Juniper Networks Junos OS Evolved)
- [CVE-2026-77524](https://cve.now/CVE-2026-77524.md): KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication (CVSS 9.9, kedacore keda · github.com/kedacore/keda +1)
- [CVE-2026-101967](https://cve.now/CVE-2026-101967.md): Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used (CVSS 8.8, Juniper Networks Junos OS Evolved)
- [CVE-2026-102068](https://cve.now/CVE-2026-102068.md): Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-101960](https://cve.now/CVE-2026-101960.md): Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-101978](https://cve.now/CVE-2026-101978.md): Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used (CVSS 8.8, Juniper Networks Junos OS Evolved)
- [CVE-2026-101985](https://cve.now/CVE-2026-101985.md): Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-101966](https://cve.now/CVE-2026-101966.md): Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service (CVSS 8.2, Juniper Networks Junos OS Evolved)
- [CVE-2026-77564](https://cve.now/CVE-2026-77564.md): Talos Linux: Support bundle does not redact registry credentials (CVSS 3.3, siderolabs talos · github.com/siderolabs/talos)
- [CVE-2026-86565](https://cve.now/CVE-2026-86565.md): Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVSS 8.2, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86563](https://cve.now/CVE-2026-86563.md): Dpdk: dpdk: double offset bug in vhost log mapping calculation (CVSS 7.8, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-86562](https://cve.now/CVE-2026-86562.md): Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) (CVSS 7.8, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-76519](https://cve.now/CVE-2026-76519.md): Cisco Secure Email Gateway Arbitrary File Write Vulnerability (CVSS 9.8, KEV, Cisco Secure Email)
- [CVE-2026-67418](https://cve.now/CVE-2026-67418.md): RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers (CVSS 5.3, rabbitmq-server · rabbitmq)
- [CVE-2026-67414](https://cve.now/CVE-2026-67414.md): RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation (CVSS 6.0, rabbitmq-server · rabbitmq)
- [CVE-2026-100169](https://cve.now/CVE-2026-100169.md): Account pre-hijacking in the Prowler API through email based social account linking without verification (CVSS 7.6, Prowler · prowler-cloud)
- [CVE-2026-67416](https://cve.now/CVE-2026-67416.md): RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation (CVSS 5.3, rabbitmq-server · rabbitmq)
- [CVE-2026-102695](https://cve.now/CVE-2026-102695.md): OmniFaces: Forged combined-resource IDs and related output/push boundaries (CVSS 8.2, omnifaces · org.omnifaces:omnifaces)
- [CVE-2026-53615](https://cve.now/CVE-2026-53615.md): util-linux libblkid DOS extended-partition overflow produces invalid partition metadata (CVSS 8.0, util-linux)
- [CVE-2026-86002](https://cve.now/CVE-2026-86002.md): Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER\_ARGS (CVSS 9.0, dokku)
- [CVE-2026-109438](https://cve.now/CVE-2026-109438.md): 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4 (CVSS 6.3, 3proxy)
- [CVE-2026-110736](https://cve.now/CVE-2026-110736.md): Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized\_translation.cpp, OptimizedTr (CVSS 3.6, godotengine Godot Engine)
- [CVE-2026-100404](https://cve.now/CVE-2026-100404.md): Zulip: Guests can read new messages in non-subscribed public channels (CVSS 6.5, zulip)
- [CVE-2026-102893](https://cve.now/CVE-2026-102893.md): Zulip: OpenID Connect authentication ignores the email\_verified claim (CVSS 9.1, zulip)
- [CVE-2026-49206](https://cve.now/CVE-2026-49206.md): rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access (CVSS 2.9, d99kris rapidcsv)
- [CVE-2026-62858](https://cve.now/CVE-2026-62858.md): YOURLS: Unauthenticated File Inclusion (CVSS 5.3, YOURLS · yourls/yourls)
- [CVE-2026-86561](https://cve.now/CVE-2026-86561.md): Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup (CVSS 6.5, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-93683](https://cve.now/CVE-2026-93683.md): Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou (CVSS 6.4, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-110735](https://cve.now/CVE-2026-110735.md): Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource\_format\_binary.cpp, ResourceLoaderB (CVSS 2.5, godotengine Godot Engine)
- [CVE-2026-53614](https://cve.now/CVE-2026-53614.md): util-linux LIBMOUNT\_FORCE\_MOUNT2 allows nosuid and noexec bypass (CVSS 7.0, util-linux)
- [CVE-2026-100394](https://cve.now/CVE-2026-100394.md): Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-91157](https://cve.now/CVE-2026-91157.md): Discourse: Media uploads remain publicly accessible after category permissions are restricted (CVSS 7.5, discourse)
- [CVE-2026-110734](https://cve.now/CVE-2026-110734.md): Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image\_loader\_hdr.cpp). (CVSS 2.5, godotengine Godot Engine)
- [CVE-2026-91156](https://cve.now/CVE-2026-91156.md): Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users (CVSS 7.5, discourse)
- [CVE-2026-91159](https://cve.now/CVE-2026-91159.md): Discourse: Stored oEmbed HTML injection via allowed iframe (CVSS 7.7, discourse)
- [CVE-2026-77572](https://cve.now/CVE-2026-77572.md): VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\\\.\\VeraCrypt (CVSS 3.3, VeraCrypt)
- [CVE-2026-91883](https://cve.now/CVE-2026-91883.md): Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in (CVSS 4.3, Dell Terraform Provider for OME)
- [CVE-2026-89077](https://cve.now/CVE-2026-89077.md): MOVEit Transfer Identity validation flaw in SFTP authentication (CVSS 7.5, Progress MOVEit Transfer)
- [CVE-2026-91882](https://cve.now/CVE-2026-91882.md): Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible Fil (CVSS 8.6, Dell Terraform Provider for OME)
- [CVE-2026-89076](https://cve.now/CVE-2026-89076.md): MOVEit Transfer SQL injection in custom reporting (CVSS 7.2, Progress MOVEit Transfer)
- [CVE-2026-89075](https://cve.now/CVE-2026-89075.md): MOVEit Transfer Local Disclosure of Session Information Vulnerability (CVSS 7.3, Progress MOVEit Transfer)
- [CVE-2026-89074](https://cve.now/CVE-2026-89074.md): MOVEit Transfer Email MFA Bypass (CVSS 7.5, Progress MOVEit Transfer)
- [CVE-2026-89073](https://cve.now/CVE-2026-89073.md): MOVEit Transfer Access restriction bypass in OAuth authentication (CVSS 7.5, Progress MOVEit Transfer)
- [CVE-2026-103929](https://cve.now/CVE-2026-103929.md): mise permits untrusted local configuration to override default shell arguments (CVSS 7.8, jdx mise · mise)
- [CVE-2026-89072](https://cve.now/CVE-2026-89072.md): MOVEit Transfer Authorization Flaw in Certificate Management (CVSS 7.5, Progress MOVEit Transfer)
- [CVE-2026-91881](https://cve.now/CVE-2026-91881.md): Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transpor (CVSS 9.0, Dell Terraform Provider for Redfish)
- [CVE-2026-89071](https://cve.now/CVE-2026-89071.md): MOVEit Transfer LDAP injection in certificate-based authentication (CVSS 7.5, Progress MOVEit Transfer)
- [CVE-2026-89070](https://cve.now/CVE-2026-89070.md): MOVEit Transfer OIDC Authentication Replay Vulnerability (CVSS 7.5, Progress MOVEit Transfer)
- [CVE-2026-89069](https://cve.now/CVE-2026-89069.md): MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages (CVSS 8.0, Progress MOVEit Transfer)
- [CVE-2026-89068](https://cve.now/CVE-2026-89068.md): MOVEit Transfer Authentication bypass in LDAP sign-on (CVSS 8.1, Progress MOVEit Transfer)
- [CVE-2026-101896](https://cve.now/CVE-2026-101896.md): Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) (CVSS 8.2, angular · @angular router +1)
- [CVE-2026-89067](https://cve.now/CVE-2026-89067.md): MOVEit Transfer Secure Messaging Authentication Bypass (CVSS 8.8, Progress MOVEit Transfer)
- [CVE-2026-76113](https://cve.now/CVE-2026-76113.md): Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vu (CVSS 4.3, Dell Terraform Provider for Redfish)
- [CVE-2026-87093](https://cve.now/CVE-2026-87093.md): MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation (CVSS 8.8, Progress MOVEit Transfer)
- [CVE-2026-101897](https://cve.now/CVE-2026-101897.md): Angular DevTools (Local DoS) (CVSS 5.1, angular)
- [CVE-2026-110719](https://cve.now/CVE-2026-110719.md): Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header (CVSS 6.9, Portkey-AI gateway)
- [CVE-2026-110718](https://cve.now/CVE-2026-110718.md): TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download (CVSS 8.2, TurboDocx html-to-docx)
- [CVE-2026-110717](https://cve.now/CVE-2026-110717.md): Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename (CVSS 6.9, meetecho janus-gateway)
- [CVE-2026-110716](https://cve.now/CVE-2026-110716.md): unshield through 1.6.2 Heap Out-of-Bounds Read via unshield\_get\_file\_table (CVSS 6.8, twogood unshield)
- [CVE-2026-110715](https://cve.now/CVE-2026-110715.md): MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort (CVSS 6.9, Artifex Software MuJS)
- [CVE-2026-110714](https://cve.now/CVE-2026-110714.md): libsmb2 through 6.2 Heap Out-of-Bounds Read via decode\_acl Integer Underflow (CVSS 7.1, sahlberg libsmb2)
- [CVE-2026-110713](https://cve.now/CVE-2026-110713.md): libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders (CVSS 7.1, sahlberg libsmb2)
- [CVE-2026-110712](https://cve.now/CVE-2026-110712.md): libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2\_decode\_file\_all\_info (CVSS 7.1, sahlberg libsmb2)
- [CVE-2026-110661](https://cve.now/CVE-2026-110661.md): CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI\_read\_node\_header (CVSS 4.8, CGNS)
- [CVE-2026-110660](https://cve.now/CVE-2026-110660.md): vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder (CVSS 4.8, vgmstream)
- [CVE-2026-110659](https://cve.now/CVE-2026-110659.md): ELFIO through 3.12 NULL Pointer Dereference via relocation\_section\_accessor get\_entry (CVSS 6.8, serge1 ELFIO)
- [CVE-2026-110658](https://cve.now/CVE-2026-110658.md): Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg\_multipart\_parse (CVSS 6.9, freeswitch sofia-sip)
- [CVE-2026-110657](https://cve.now/CVE-2026-110657.md): Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label (CVSS 4.8, Khronos Group nnef · Khronos Group nnef-tools)
- [CVE-2026-110656](https://cve.now/CVE-2026-110656.md): miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt (CVSS 2.3, miniupnp project miniupnpc)
- [CVE-2026-110655](https://cve.now/CVE-2026-110655.md): miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt (CVSS 2.3, miniupnp project miniupnpc)
- [CVE-2026-110654](https://cve.now/CVE-2026-110654.md): libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert\_drcs (CVSS 6.9, zapping-vbi libzvbi)
- [CVE-2026-101895](https://cve.now/CVE-2026-101895.md): Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE (CVSS 8.7, angular · @angular/ platform-server +1)
- [CVE-2026-107381](https://cve.now/CVE-2026-107381.md): svg-sanitizer: Mixed-case xlink:HrEf skips the \`\<use\>\` nesting-DoS check in Resolver::processReferences (CVSS 6.5, darylldoyle svg-sanitizer · enshrined/svg-sanitize)
- [CVE-2026-53613](https://cve.now/CVE-2026-53613.md): util-linux mount target TOCTOU allows local privilege escalation (CVSS 7.0, util-linux)
- [CVE-2026-53612](https://cve.now/CVE-2026-53612.md): util-linux mount hook\_owner TOCTOU allows local privilege escalation (CVSS 7.0, util-linux)
- [CVE-2026-104939](https://cve.now/CVE-2026-104939.md): NGINX Ingress Controller vulnerability (CVSS 7.5, F5 NGINX Ingress Controller)
- [CVE-2026-101019](https://cve.now/CVE-2026-101019.md): NGINX ngx\_http\_js\_module vulnerability (CVSS 6.5, F5 NGINX JavaScript)
- [CVE-2026-101025](https://cve.now/CVE-2026-101025.md): NGINX ngx\_http\_js\_module vulnerability (CVSS 5.3, F5 NGINX JavaScript)
- [CVE-2026-95101](https://cve.now/CVE-2026-95101.md): NGINX ngx\_http\_v3\_module vulnerability (CVSS 5.3, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-94197](https://cve.now/CVE-2026-94197.md): NGINX Ingress Controller vulnerability (CVSS 7.5, F5 NGINX Ingress Controller)
- [CVE-2026-96615](https://cve.now/CVE-2026-96615.md): NGINX Gateway Fabric vulnerability (CVSS 6.5, F5 NGINX Gateway Fabric)
- [CVE-2026-91184](https://cve.now/CVE-2026-91184.md): NGINX Gateway Fabric vulnerability (CVSS 8.8, F5 NGINX Gateway Fabric)
- [CVE-2026-97205](https://cve.now/CVE-2026-97205.md): NGINX ngx\_http\_core\_module vulnerability (CVSS 8.1, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-93479](https://cve.now/CVE-2026-93479.md): NGINX map directive and regex matching vulnerability (CVSS 8.1, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-97629](https://cve.now/CVE-2026-97629.md): NGINX ngx\_http\_ssl\_module vulnerability (CVSS 6.5, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-15176](https://cve.now/CVE-2026-15176.md): NGINX ngx\_http\_core\_module vulnerability (CVSS 8.1, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-78433](https://cve.now/CVE-2026-78433.md): Gitea private attachment disclosure through repository mismatch (CVSS 5.9, Gitea)
- [CVE-2026-78231](https://cve.now/CVE-2026-78231.md): Gitea blind SSRF through OpenID assertion verification (CVSS 5.3, Gitea)
- [CVE-2026-73814](https://cve.now/CVE-2026-73814.md): Gitea repository ownership escalation by administrators (CVSS 6.5, Gitea)
- [CVE-2026-73804](https://cve.now/CVE-2026-73804.md): Gitea API token scope escalation through HTTP signatures (CVSS 8.1, Gitea)
- [CVE-2026-73802](https://cve.now/CVE-2026-73802.md): Gitea Runner host isolation bypass through container options (CVSS 8.8, Gitea Runner · gitea.com/gitea/runner)
- [CVE-2026-73800](https://cve.now/CVE-2026-73800.md): Gitea reusable workflow secret exposure in pull\_request\_target (CVSS 8.8, Gitea)
- [CVE-2026-73539](https://cve.now/CVE-2026-73539.md): Gitea external renderer argument injection and code execution (CVSS 7.5, Gitea)
- [CVE-2026-73535](https://cve.now/CVE-2026-73535.md): Gitea second-factor bypass through OpenID identity linking (CVSS 8.8, Gitea)
- [CVE-2026-73273](https://cve.now/CVE-2026-73273.md): Gitea Maven checksum upload quota bypass and memory exhaustion (CVSS 4.3, Gitea)
- [CVE-2026-73135](https://cve.now/CVE-2026-73135.md): Gitea hidden-owner repository listing disclosure (CVSS 5.3, Gitea)
- [CVE-2026-73130](https://cve.now/CVE-2026-73130.md): Gitea repository initialization resource exhaustion (CVSS 4.3, Gitea)
- [CVE-2026-73126](https://cve.now/CVE-2026-73126.md): Gitea private workflow badge token scope bypass (CVSS 4.3, Gitea)
- [CVE-2026-71301](https://cve.now/CVE-2026-71301.md): Gitea private pull request title disclosure through markup (CVSS 4.3, Gitea)
- [CVE-2026-71184](https://cve.now/CVE-2026-71184.md): Gitea fork workflow approval bypass through review events (CVSS 8.8, Gitea)
- [CVE-2026-70407](https://cve.now/CVE-2026-70407.md): Gitea organization listing token scope bypass (CVSS 4.3, Gitea)
- [CVE-2026-70406](https://cve.now/CVE-2026-70406.md): Gitea private comparison disclosure with public-only tokens (CVSS 6.5, Gitea)
- [CVE-2026-70402](https://cve.now/CVE-2026-70402.md): Gitea local code execution through writable Git hooks (CVSS 5.8, Gitea)
- [CVE-2026-70400](https://cve.now/CVE-2026-70400.md): Gitea private migration creation with public-only tokens (CVSS 5.4, Gitea)
- [CVE-2026-70396](https://cve.now/CVE-2026-70396.md): Gitea organization repository creation token scope bypass (CVSS 5.4, Gitea)
- [CVE-2026-68964](https://cve.now/CVE-2026-68964.md): Gitea restricted-user SSH and GPG key metadata disclosure (CVSS 4.3, Gitea)
- [CVE-2026-68957](https://cve.now/CVE-2026-68957.md): Gitea restricted-user issue search disclosure (CVSS 4.3, Gitea)
- [CVE-2026-67577](https://cve.now/CVE-2026-67577.md): Gitea restricted-user activity and heatmap disclosure (CVSS 4.3, Gitea)
- [CVE-2026-66877](https://cve.now/CVE-2026-66877.md): Gitea fork workflow approval bypass through concurrency cancellation (CVSS 8.1, Gitea)
- [CVE-2026-66874](https://cve.now/CVE-2026-66874.md): Gitea required Actions check bypass through skipped workflows (CVSS 6.5, Gitea)
- [CVE-2026-66853](https://cve.now/CVE-2026-66853.md): Gitea restricted-user organization metadata disclosure (CVSS 4.3, Gitea)
- [CVE-2026-66849](https://cve.now/CVE-2026-66849.md): Gitea restricted-user package visibility bypass (CVSS 4.3, Gitea)
- [CVE-2026-84471](https://cve.now/CVE-2026-84471.md): The fix for CVE-2026-12996 was incomplete. (CVSS 7.2, OpenVPN)
- [CVE-2026-63792](https://cve.now/CVE-2026-63792.md): Gitea private reusable workflow disclosure to fork runs (CVSS 5.3, Gitea)
- [CVE-2026-63021](https://cve.now/CVE-2026-63021.md): Gitea Swift package manifest memory exhaustion (CVSS 6.5, Gitea)
- [CVE-2026-62925](https://cve.now/CVE-2026-62925.md): Gitea Alpine package parsing memory exhaustion (CVSS 6.5, Gitea)
- [CVE-2026-60021](https://cve.now/CVE-2026-60021.md): Gitea GitLab migration denial of service (CVSS 6.5, Gitea)
- [CVE-2026-60018](https://cve.now/CVE-2026-60018.md): Gitea OneDev migration denial of service (CVSS 6.5, Gitea)
- [CVE-2026-60010](https://cve.now/CVE-2026-60010.md): Gitea organization team policy bypass through repository API (CVSS 6.5, Gitea)
- [CVE-2026-60008](https://cve.now/CVE-2026-60008.md): Gitea Jupyter notebook UI redress through CSS class injection (CVSS 3.5, Gitea)
- [CVE-2026-59774](https://cve.now/CVE-2026-59774.md): Gitea Org-mode file disclosure and code execution (CVSS 9.8, Gitea)
- [CVE-2026-59766](https://cve.now/CVE-2026-59766.md): Gitea private repository metadata disclosure after access revocation (CVSS 4.3, Gitea · code.gitea.io/gitea +1)
- [CVE-2026-25946](https://cve.now/CVE-2026-25946.md): Gitea OpenID discovery server-side request forgery (CVSS 5.3, Gitea)
- [CVE-2026-110650](https://cve.now/CVE-2026-110650.md): Thumbnail through 1.5 OS Command Injection via generate\_thumbnail File Paths (CVSS 9.3, anshulkharb thumbnail)
- [CVE-2026-110649](https://cve.now/CVE-2026-110649.md): Stills before 25.24.2 OS Command Injection via Media File Names (CVSS 9.3, shahkashani stills)
- [CVE-2026-110648](https://cve.now/CVE-2026-110648.md): @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names (CVSS 8.5, adamarcanov compress-fonts)
- [CVE-2026-110647](https://cve.now/CVE-2026-110647.md): Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names (CVSS 8.5, jinghaihan turnpress)
- [CVE-2026-110646](https://cve.now/CVE-2026-110646.md): Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl() (CVSS 9.2, beganovich snappdf)
- [CVE-2026-110645](https://cve.now/CVE-2026-110645.md): Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut() (CVSS 9.3, ArsalanDotMe video-stitch)
- [CVE-2026-110644](https://cve.now/CVE-2026-110644.md): nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType (CVSS 9.3, ChetanXpro nodejs-whisper)
- [CVE-2026-110643](https://cve.now/CVE-2026-110643.md): transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath (CVSS 9.3, kky-ykk transcribe2texts)
- [CVE-2026-110642](https://cve.now/CVE-2026-110642.md): xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name (CVSS 8.5, xhtml2pdf)
- [CVE-2026-110641](https://cve.now/CVE-2026-110641.md): @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name (CVSS 8.7, @runnerty/executor-decompress)
- [CVE-2026-110640](https://cve.now/CVE-2026-110640.md): Whisper-node through 1.1.1 OS Command Injection via filePath and language (CVSS 9.3, ariym whisper-node)
- [CVE-2026-110639](https://cve.now/CVE-2026-110639.md): @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir (CVSS 9.3, @mborne/extract)
- [CVE-2026-110638](https://cve.now/CVE-2026-110638.md): doc-recog through 1.1.6 OS Command Injection via DocData.\_readPDF File Path (CVSS 9.3, zepspaiva doc-recog)
- [CVE-2026-110637](https://cve.now/CVE-2026-110637.md): buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name (CVSS 8.5, wastemobile buildebooks)
- [CVE-2026-110636](https://cve.now/CVE-2026-110636.md): pypdftk through 0.5 OS Command Injection via PDF and Output Paths (CVSS 9.3, revolunet pypdftk)
- [CVE-2026-110635](https://cve.now/CVE-2026-110635.md): webp-converter before 3.0.0 OS Command Injection via File Names and Options (CVSS 9.3, scionoftech webp-converter)
- [CVE-2026-110634](https://cve.now/CVE-2026-110634.md): git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings (CVSS 9.3, danday74 git-diff · git-diff)
- [CVE-2026-110633](https://cve.now/CVE-2026-110633.md): MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service (CVSS 8.5, Report One MyReport Updater)
- [CVE-2026-110632](https://cve.now/CVE-2026-110632.md): Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE (CVSS 9.2, Report One MyReport Updater)
- [CVE-2026-110631](https://cve.now/CVE-2026-110631.md): Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration (CVSS 9.3, moghtech komodo)
- [CVE-2026-110630](https://cve.now/CVE-2026-110630.md): VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment (CVSS 7.0, venturedrake laravel-crm)
- [CVE-2026-110629](https://cve.now/CVE-2026-110629.md): VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions (CVSS 7.1, venturedrake laravel-crm)
- [CVE-2026-110628](https://cve.now/CVE-2026-110628.md): Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment (CVSS 9.2, kanbn kan)
- [CVE-2026-110627](https://cve.now/CVE-2026-110627.md): ClipBucket v5 through 5.5.3-#206 Reflected XSS via add\_todo val Parameter (CVSS 2.1, MacWarrior clipbucket-v5)
- [CVE-2026-110626](https://cve.now/CVE-2026-110626.md): ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit\_language in language\_settings.php (CVSS 5.1, MacWarrior clipbucket-v5)
- [CVE-2026-110625](https://cve.now/CVE-2026-110625.md): ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged\_item.php (CVSS 5.1, MacWarrior clipbucket-v5)
- [CVE-2026-110624](https://cve.now/CVE-2026-110624.md): Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all (CVSS 2.3, papermerge-core)
- [CVE-2026-110623](https://cve.now/CVE-2026-110623.md): Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API (CVSS 7.7, papermerge-core)
- [CVE-2026-110622](https://cve.now/CVE-2026-110622.md): Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints (CVSS 7.7, papermerge-core)
- [CVE-2026-110621](https://cve.now/CVE-2026-110621.md): Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId (CVSS 8.7, swetrix)
- [CVE-2026-110620](https://cve.now/CVE-2026-110620.md): Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId (CVSS 6.1, formbricks)
- [CVE-2026-110619](https://cve.now/CVE-2026-110619.md): frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints (CVSS 6.3, fatedier frp)
- [CVE-2026-110618](https://cve.now/CVE-2026-110618.md): SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API (CVSS 8.6, pppscn SmsForwarder)
- [CVE-2026-110617](https://cve.now/CVE-2026-110617.md): we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint (CVSS 6.3, rachelos we-mp-rss)
- [CVE-2026-110616](https://cve.now/CVE-2026-110616.md): NullHub through 2026.5.29 Missing Authentication for /api Management API (CVSS 9.2, nullclaw NullHub)
- [CVE-2026-110615](https://cve.now/CVE-2026-110615.md): jshERP through 3.6 Missing Authorization via /user/batchSetStatus (CVSS 7.1, jishenghua jshERP)
- [CVE-2026-110614](https://cve.now/CVE-2026-110614.md): Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter (CVSS 7.1, Yiuman citrus)
- [CVE-2026-110613](https://cve.now/CVE-2026-110613.md): youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List (CVSS 7.1, youlaitech youlai-mall)
- [CVE-2026-110612](https://cve.now/CVE-2026-110612.md): vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil (CVSS 9.3, wwwlike vlife)
- [CVE-2026-110611](https://cve.now/CVE-2026-110611.md): REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid (CVSS 6.0, getrebuild rebuild)
- [CVE-2026-110610](https://cve.now/CVE-2026-110610.md): ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl (CVSS 5.3, YunaiV ruoyi-vue-pro)
- [CVE-2026-110609](https://cve.now/CVE-2026-110609.md): Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter (CVSS 7.1, dromara skyeye)
- [CVE-2026-110608](https://cve.now/CVE-2026-110608.md): BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive (CVSS 5.3, BizSpring Shop · BizSpring Java Mall)
- [CVE-2026-110607](https://cve.now/CVE-2026-110607.md): BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test\_post\_pay Endpoint (CVSS 7.1, BizSpring Shop · BizSpring Java Mall)
- [CVE-2026-110606](https://cve.now/CVE-2026-110606.md): LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader (CVSS 4.8, LibreCAD libdxfrw · LibreCAD)
- [CVE-2026-110605](https://cve.now/CVE-2026-110605.md): libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw\_line (CVSS 6.8, tomolt libschrift)
- [CVE-2026-110604](https://cve.now/CVE-2026-110604.md): Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml\_strtod() (CVSS 2.0, Michael R Sweet Mini-XML)
- [CVE-2026-110603](https://cve.now/CVE-2026-110603.md): LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip\_read\_header (CVSS 5.8, rapidlasso LASzip)
- [CVE-2026-110602](https://cve.now/CVE-2026-110602.md): libmspack through 0.11alpha Uninitialized Pointer Free via kwajd\_open Error Path (CVSS 5.8, kyz libmspack)
- [CVE-2026-110601](https://cve.now/CVE-2026-110601.md): libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF (CVSS 5.8, saitoha libsixel)
- [CVE-2026-110600](https://cve.now/CVE-2026-110600.md): xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id (CVSS 6.8, brechtsanders xlsxio)
- [CVE-2026-110599](https://cve.now/CVE-2026-110599.md): L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe (CVSS 6.9, l-smash)
- [CVE-2026-110598](https://cve.now/CVE-2026-110598.md): Libyal libpff through 20260926 heap out-of-bounds read via libpff\_record\_entry\_get\_multi\_value (CVSS 6.9, libyal libpff)
- [CVE-2026-110597](https://cve.now/CVE-2026-110597.md): Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory (CVSS 6.9, syoyo tinyexr)
- [CVE-2026-110596](https://cve.now/CVE-2026-110596.md): quirc through 1.2 Denial of Service via find\_alignment\_pattern Spiral Search (CVSS 6.8, dlbeer quirc)
- [CVE-2026-110595](https://cve.now/CVE-2026-110595.md): BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import (CVSS 5.3, MicroPyramid BottleCRM)
- [CVE-2026-110594](https://cve.now/CVE-2026-110594.md): BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex (CVSS 6.9, MicroPyramid BottleCRM)
- [CVE-2026-110593](https://cve.now/CVE-2026-110593.md): BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create\_mail (CVSS 5.3, MicroPyramid BottleCRM)
- [CVE-2026-110592](https://cve.now/CVE-2026-110592.md): BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template (CVSS 5.1, MicroPyramid BottleCRM)
- [CVE-2026-110591](https://cve.now/CVE-2026-110591.md): OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer (CVSS 6.8, OW2 ASM)
- [CVE-2026-110270](https://cve.now/CVE-2026-110270.md): OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter (CVSS 6.8, OW2 ASM)
- [CVE-2026-110263](https://cve.now/CVE-2026-110263.md): OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader (CVSS 6.8, OW2 ASM)
- [CVE-2026-110262](https://cve.now/CVE-2026-110262.md): OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter (CVSS 4.8, OW2 ASM)
- [CVE-2026-110261](https://cve.now/CVE-2026-110261.md): OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE\_FRAMES (CVSS 6.8, OW2 ASM)
- [CVE-2026-110260](https://cve.now/CVE-2026-110260.md): OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers (CVSS 6.8, OW2 ASM)
- [CVE-2026-110259](https://cve.now/CVE-2026-110259.md): OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions() (CVSS 6.8, OW2 ASM)
- [CVE-2026-110258](https://cve.now/CVE-2026-110258.md): OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions (CVSS 6.8, OW2 ASM)
- [CVE-2026-110257](https://cve.now/CVE-2026-110257.md): OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute (CVSS 6.8, OW2 ASM)
- [CVE-2025-71433](https://cve.now/CVE-2025-71433.md): Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access (CVSS 7.7, usekaneo kaneo)
- [CVE-2024-58392](https://cve.now/CVE-2024-58392.md): PhysicsFS through 3.2.0 Out-of-Bounds Read via \_\_PHYSFS\_utf8codepoint (CVSS 4.8, icculus PhysicsFS)
- [CVE-2020-37282](https://cve.now/CVE-2020-37282.md): office-converter through 1.0.2 OS Command Injection via fileName in generatePdf (CVSS 9.3, vworld4u office-converter)
- [CVE-2020-37281](https://cve.now/CVE-2020-37281.md): Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass (CVSS 9.2, Gravitee API Management)
- [CVE-2017-20286](https://cve.now/CVE-2017-20286.md): DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette (CVSS 8.5, DentonW DevIL)
- [CVE-2016-20099](https://cve.now/CVE-2016-20099.md): L-SMASH through 2.14.5 Infinite Loop in VC-1 Importer Probe (CVSS 6.8, l-smash)
- [CVE-2026-35161](https://cve.now/CVE-2026-35161.md): Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. (CVSS 5.3, Dell PowerScale InsightIQ)
- [CVE-2026-104086](https://cve.now/CVE-2026-104086.md): 7-Zip \< 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table (CVSS 6.8, 7-Zip)
- [CVE-2026-107870](https://cve.now/CVE-2026-107870.md): WordPress JetEngine plugin \<= 3.8.16 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetEngine)
- [CVE-2026-94348](https://cve.now/CVE-2026-94348.md): Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQ (CVSS 6.1, Dell PowerScale InsightIQ)
- [CVE-2026-101215](https://cve.now/CVE-2026-101215.md): Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS C (CVSS 6.6, Dell Unisphere for PowerMax vApp)
- [CVE-2026-101217](https://cve.now/CVE-2026-101217.md): Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Trave (CVSS 6.5, Dell Unisphere for PowerMax vApp)
- [CVE-2026-110690](https://cve.now/CVE-2026-110690.md): Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack (CVSS 8.7, coderaiser cloudcmd)
- [CVE-2026-101216](https://cve.now/CVE-2026-101216.md): Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command (CVSS 6.6, Dell Unisphere for PowerMax vApp)
- [CVE-2026-108065](https://cve.now/CVE-2026-108065.md): Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce (CVSS 9.8, Channel Software WebAlliance eCommerce)
- [CVE-2026-98431](https://cve.now/CVE-2026-98431.md): RDMA/uverbs: Fix mmap\_lock/disassociation\_lock circular dependency (no CVSS, Linux)
- [CVE-2026-98430](https://cve.now/CVE-2026-98430.md): RDMA/efa: Keep admin queues alive while IRQ is registered (no CVSS, Linux)
- [CVE-2026-98429](https://cve.now/CVE-2026-98429.md): RDMA/efa: Keep EQ resources alive while IRQ is registered (no CVSS, Linux)
- [CVE-2026-98428](https://cve.now/CVE-2026-98428.md): ALSA: usb: 6fire: Avoid embedded URBs (no CVSS, Linux)
- [CVE-2026-98427](https://cve.now/CVE-2026-98427.md): net/sched: codel: bound the dropping loop per dequeue call (no CVSS, Linux)
- [CVE-2026-98426](https://cve.now/CVE-2026-98426.md): wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (no CVSS, Linux)
- [CVE-2026-98425](https://cve.now/CVE-2026-98425.md): wifi: mac80211: don't warn when an IBSS has no channel to scan (no CVSS, Linux)
- [CVE-2026-98424](https://cve.now/CVE-2026-98424.md): wifi: cfg80211: undo netns switch if renaming the wiphy fails (no CVSS, Linux)
- [CVE-2026-98423](https://cve.now/CVE-2026-98423.md): wifi: mac80211\_hwsim: don't hand frames to mac80211 while stopping (no CVSS, Linux)
- [CVE-2026-98422](https://cve.now/CVE-2026-98422.md): wifi: mac80211: reset the AP\_VLAN tailroom counter on ifdown (no CVSS, Linux)
- [CVE-2026-98421](https://cve.now/CVE-2026-98421.md): wifi: mac80211: require a peer station for TDLS setup confirm (no CVSS, Linux)
- [CVE-2026-98420](https://cve.now/CVE-2026-98420.md): ksmbd: follow SMB2 session expiration semantics (no CVSS, Linux)
- [CVE-2026-98419](https://cve.now/CVE-2026-98419.md): drop\_monitor: fix out-of-bounds write in reset\_per\_cpu\_data() (CVSS 7.0, Linux)
- [CVE-2026-98418](https://cve.now/CVE-2026-98418.md): sched/core: Avoid false migration warning for proxy donors (no CVSS, Linux)
- [CVE-2026-98417](https://cve.now/CVE-2026-98417.md): net: xfrm: reject unrepresentable espintcp transport headers (no CVSS, Linux)
- [CVE-2026-98416](https://cve.now/CVE-2026-98416.md): dmaengine: ti: k3-udma-glue: fix NULL dereference in k3\_udma\_glue\_release\_rx\_chn() (no CVSS, Linux)
- [CVE-2026-98415](https://cve.now/CVE-2026-98415.md): soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node (no CVSS, Linux)
- [CVE-2026-98414](https://cve.now/CVE-2026-98414.md): memcg: avoid charging the root memcg from obj\_cgroup\_charge\_pages() (no CVSS, Linux)
- [CVE-2026-98413](https://cve.now/CVE-2026-98413.md): selinux: always fill AVC decision in avc\_has\_perm\_noaudit() (no CVSS, Linux)
- [CVE-2026-98412](https://cve.now/CVE-2026-98412.md): power: sequencing: fix NULL-pointer dereference in pwrseq\_unit\_new() (no CVSS, Linux)
- [CVE-2026-98411](https://cve.now/CVE-2026-98411.md): power: sequencing: fix NULL-pointer dereference in pwrseq\_device\_register() (no CVSS, Linux)
- [CVE-2026-98410](https://cve.now/CVE-2026-98410.md): watchdog: da9063: fix suspend/resume handling of HW\_RUNNING watchdog (no CVSS, Linux)
- [CVE-2026-98409](https://cve.now/CVE-2026-98409.md): watchdog: rtd119x: Avoid division by zero (no CVSS, Linux)
- [CVE-2026-98408](https://cve.now/CVE-2026-98408.md): watchdog: rzv2h: Avoid division by zero (no CVSS, Linux)
- [CVE-2026-98407](https://cve.now/CVE-2026-98407.md): wifi: rsi: fix heap OOB write on key removal (no CVSS, Linux)
- [CVE-2026-98406](https://cve.now/CVE-2026-98406.md): wifi: mac80211: avoid WARN in set\_bitrate\_mask when sdata not in driver (no CVSS, Linux)
- [CVE-2026-98405](https://cve.now/CVE-2026-98405.md): smb: client: fix missing iov bounds check in parse\_posix\_sids() (CVSS 8.1, Linux)
- [CVE-2026-98404](https://cve.now/CVE-2026-98404.md): drm/virtio: Fix a NULL vs ERR\_PTR() bug in virtio\_gpu\_user\_framebuffer\_create() (no CVSS, Linux)
- [CVE-2026-98403](https://cve.now/CVE-2026-98403.md): s390/boot: Avoid IPL parameter append past command line (no CVSS, Linux)
- [CVE-2026-98402](https://cve.now/CVE-2026-98402.md): net: icmp: avoid invalid transport header access in icmp\_send tracepoint (no CVSS, Linux)
- [CVE-2026-98401](https://cve.now/CVE-2026-98401.md): net: iptunnel: fix stale transport header during tunnel decapsulation (CVSS 7.5, Linux)
- [CVE-2026-98400](https://cve.now/CVE-2026-98400.md): s390/ipl: Fix NULL deref in kdump without re-IPL parm block (no CVSS, Linux)
- [CVE-2026-98399](https://cve.now/CVE-2026-98399.md): s390/ipl: Fix NULL deref in dump\_reipl without re-IPL parm block (no CVSS, Linux)
- [CVE-2026-98398](https://cve.now/CVE-2026-98398.md): locking/lockdep: Invalidate stale class\_cache entries for zapped classes (no CVSS, Linux)
- [CVE-2026-98397](https://cve.now/CVE-2026-98397.md): platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown (no CVSS, Linux)
- [CVE-2026-98396](https://cve.now/CVE-2026-98396.md): powerpc: Do not restore KUAP in arch\_exit\_to\_user\_mode\_prepare() (no CVSS, Linux)
- [CVE-2026-98395](https://cve.now/CVE-2026-98395.md): powerpc/entry: Fix irq\_soft\_mask corruption on replayed interrupt exit (no CVSS, Linux)
- [CVE-2026-98394](https://cve.now/CVE-2026-98394.md): af\_unix: Return immediately when manage\_oob() returns NULL for 0-length buffer. (no CVSS, Linux)
- [CVE-2026-98393](https://cve.now/CVE-2026-98393.md): net: ipv4: Fix UDP length overflow with PMTU discover and big MTU (no CVSS, Linux)
- [CVE-2026-98392](https://cve.now/CVE-2026-98392.md): Bluetooth: btintel\_pcie: fix tx\_handle bounds off-by-one (no CVSS, Linux)
- [CVE-2026-98391](https://cve.now/CVE-2026-98391.md): drm/xe: Guard page-fault worker with runtime PM check (no CVSS, Linux)
- [CVE-2026-98390](https://cve.now/CVE-2026-98390.md): x86/amd\_node: Avoid divide by zero on virtualized systems (no CVSS, Linux)
- [CVE-2026-98389](https://cve.now/CVE-2026-98389.md): drm/amdgpu: skip gfx switch\_power\_profile during GPU reset (no CVSS, Linux)
- [CVE-2026-98388](https://cve.now/CVE-2026-98388.md): exec: do\_close\_on\_exec() before taking exec\_update\_lock (no CVSS, Linux)
- [CVE-2026-98387](https://cve.now/CVE-2026-98387.md): s390/crypto: Fix skcipher\_walk return code handling in aes\_s390 (no CVSS, Linux)
- [CVE-2026-98386](https://cve.now/CVE-2026-98386.md): scsi: qla2xxx: Use memset\_io() to clear QLAFX00 request ring slot (no CVSS, Linux)
- [CVE-2026-110652](https://cve.now/CVE-2026-110652.md): ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass (CVSS 6.3, ONLYOFFICE DocumentServer)
- [CVE-2026-107417](https://cve.now/CVE-2026-107417.md): WordPress Push Notification for Post and BuddyPress plugin \<= 3.23 - Broken Access Control vulnerability (CVSS 6.5, Muralidharan Ramasamy Push Notification for Post and BuddyP…)
- [CVE-2026-107426](https://cve.now/CVE-2026-107426.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.5.12 - Broken Access Control vulnerability (CVSS 7.3, VideoWhisper.com Paid Videochat Turnkey Site)
- [CVE-2026-109968](https://cve.now/CVE-2026-109968.md): Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-16740](https://cve.now/CVE-2026-16740.md): Missing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP (CVSS 9.8, TR7 Cyber ​​Defense TR7 ASP)
- [CVE-2026-16741](https://cve.now/CVE-2026-16741.md): OS Command in TR7 Cyber ​​Defense's TR7 ASP (CVSS 9.8, TR7 Cyber ​​Defense TR7 ASP)
- [CVE-2026-82026](https://cve.now/CVE-2026-82026.md): Radar \< 1.12.2 Missing Authorization via /api/local-terminal (CVSS 8.7, skyhook-io radar)
- [CVE-2026-108291](https://cve.now/CVE-2026-108291.md): WordPress Affiliates plugin \<= 7.0.1 - PHP Object Injection vulnerability (CVSS 9.8, itthinx Affiliates)
- [CVE-2026-107425](https://cve.now/CVE-2026-107425.md): WordPress Bus Ticket Booking with Seat Reservation plugin \<= 5.9.7 - Broken Access Control vulnerability (CVSS 6.5, Magepeople Bus Ticket Booking with Seat Reservation)
- [CVE-2026-107867](https://cve.now/CVE-2026-107867.md): WordPress JetProductTables plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetProductTables)
- [CVE-2026-107421](https://cve.now/CVE-2026-107421.md): WordPress Broadcast Live Video plugin \<= 7.3.2 - Session Hijacking vulnerability (CVSS 7.3, VideoWhisper.com Broadcast Live Video)
- [CVE-2026-107424](https://cve.now/CVE-2026-107424.md): WordPress Frontend Dashboard plugin \<= 3.0.7 - Privilege Escalation vulnerability (CVSS 9.8, M A Vinoth Kumar Frontend Dashboard)
- [CVE-2026-107422](https://cve.now/CVE-2026-107422.md): WordPress WP w3all phpBB plugin \<= 3.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, axew3.com WP w3all phpBB)
- [CVE-2026-105874](https://cve.now/CVE-2026-105874.md): WordPress SureCart plugin \<= 4.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Brainstorm Force SureCart)
- [CVE-2026-106599](https://cve.now/CVE-2026-106599.md): WordPress SureCart plugin \<= 4.9.3 - PHP Object Injection vulnerability (CVSS 8.8, Brainstorm Force SureCart)
- [CVE-2026-97278](https://cve.now/CVE-2026-97278.md): WordPress Polylang plugin \<= 3.8.9 - PHP Object Injection vulnerability (CVSS 7.2, WP SYNTEX Polylang)
- [CVE-2026-107433](https://cve.now/CVE-2026-107433.md): WordPress WP OAuth Server plugin \<= 6.4.0 - Broken Access Control vulnerability (CVSS 6.5, miniOrange WP OAuth Server)
- [RUSTSEC-2026-0352](https://cve.now/RUSTSEC-2026-0352.md): Filesystem sandbox escape when renaming symlinks with trailing slashes (no CVSS, wasmtime-wasi)
- [RUSTSEC-2026-0353](https://cve.now/RUSTSEC-2026-0353.md): Panic when invoking an async-lifted function via \`call\` (no CVSS, wasmtime)
- [RUSTSEC-2026-0355](https://cve.now/RUSTSEC-2026-0355.md): Panic viewing component model stream or future as the wrong type (no CVSS, wasmtime)
- [RUSTSEC-2026-0356](https://cve.now/RUSTSEC-2026-0356.md): Panic on erroneous call-to-host from guest realloc call (no CVSS, wasmtime)
- [RUSTSEC-2026-0358](https://cve.now/RUSTSEC-2026-0358.md): Yielding in a component start function can lead to a host panic (no CVSS, wasmtime)
- [RUSTSEC-2026-0363](https://cve.now/RUSTSEC-2026-0363.md): Component-model handle tables are capped only per instance and charged to no limit (no CVSS, wasmtime)
- [RUSTSEC-2026-0364](https://cve.now/RUSTSEC-2026-0364.md): Exception tags can cause host data structures to be unaligned (no CVSS, wasmtime)
- [CVE-2026-76655](https://cve.now/CVE-2026-76655.md): HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability (CVSS 7.5, Hewlett Packard Enterprise HPE NonStop SNMP Trap Multiplexer)
- [CVE-2026-73798](https://cve.now/CVE-2026-73798.md): HPE NonStop DNS 9.2.3 Non Secure Version (CVSS 8.2, Hewlett Packard Enterprise HPE NonStop DNS 9.2.3 Non Secure…)
- [CVE-2026-73797](https://cve.now/CVE-2026-73797.md): HPE NonStop TSQLFIL - Memory corruption vulnerability (CVSS 5.3, Hewlett Packard Enterprise HPE NonStop TSQLFIL)
- [CVE-2026-85298](https://cve.now/CVE-2026-85298.md): Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation (CVSS 7.3, Google Cloud Application Integration)
- [CVE-2026-73796](https://cve.now/CVE-2026-73796.md): HPE NonStop TSQLEXE - Memory Corruption vulnerability (CVSS 4.4, Hewlett Packard Enterprise HPE NonStop TSQLEXE)
- [CVE-2026-108072](https://cve.now/CVE-2026-108072.md): Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation (CVSS 5.4, TSplus Remote Access)
- [CVE-2026-108071](https://cve.now/CVE-2026-108071.md): Improper Multi-Factor Authentication Validation Allows Authentication Bypass (CVSS 8.7, TSplus Remote Access)
- [CVE-2026-105067](https://cve.now/CVE-2026-105067.md): WordPress Modern Events Calendar Lite plugin \< 7.37.0 - SQL Injection vulnerability (CVSS 8.5, Webnus Modern Events Calendar Lite)
- [CVE-2026-103358](https://cve.now/CVE-2026-103358.md): WordPress Email Template Customizer for WooCommerce plugin \<= 1.3.4 - Content Injection vulnerability (CVSS 7.5, VillaTheme Email Template Customizer for WooCommerce)
- [CVE-2026-107431](https://cve.now/CVE-2026-107431.md): WordPress JetFormBuilder plugin \<= 3.6.6 - Broken Access Control vulnerability (CVSS 7.5, Crocoblock JetFormBuilder)
- [CVE-2026-101341](https://cve.now/CVE-2026-101341.md): Stack overwrite from specially formatted TXT-DATA RDATA field (CVSS 8.7, NLnet Labs NSD)
- [CVE-2026-101339](https://cve.now/CVE-2026-101339.md): Stack overwrite from a specially crafted and formatted HIP RR (CVSS 8.7, NLnet Labs NSD)
- [CVE-2026-101338](https://cve.now/CVE-2026-101338.md): Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR (CVSS 8.7, NLnet Labs NSD)
- [CVE-2026-101337](https://cve.now/CVE-2026-101337.md): Stack overwrite from specially formatted base64 RDATA field (CVSS 8.7, NLnet Labs NSD)
- [CVE-2026-104795](https://cve.now/CVE-2026-104795.md): Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution (CVSS 8.8, Red Hat OpenShift Container Platform)
- [CVE-2026-108070](https://cve.now/CVE-2026-108070.md): Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access (CVSS 8.7, TSplus Remote Access)
- [CVE-2026-103905](https://cve.now/CVE-2026-103905.md): Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop (CVSS 8.7, JTL-Software JTL-Shop)
- [CVE-2026-97315](https://cve.now/CVE-2026-97315.md): Responsive Blocks \< 2.3.0 - Unauthenticated HTML Injection in Form Notification Email (CVSS 5.4, Responsive Blocks)
- [CVE-2026-88998](https://cve.now/CVE-2026-88998.md): Tickera \< 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN (CVSS 5.3, Tickera)
- [CVE-2026-82844](https://cve.now/CVE-2026-82844.md): WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce (CVSS 5.3, WPForms Lite)
- [CVE-2026-103308](https://cve.now/CVE-2026-103308.md): Visma Pay for WooCommerce \< 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint (CVSS 6.5, Visma Pay for WooCommerce)
- [CVE-2026-101301](https://cve.now/CVE-2026-101301.md): WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass (CVSS 5.3, WPCode)
- [CVE-2026-103904](https://cve.now/CVE-2026-103904.md): Stored XSS Vulnerability in JTL-Shop (CVSS 8.6, JTL-Software JTL-Shop)
- [CVE-2026-73795](https://cve.now/CVE-2026-73795.md): HPE NonStop TMF Auditread2 - Denial of Service vulnerability (CVSS 6.4, Hewlett Packard Enterprise HPE NonStop TMF Auditread2)
- [CVE-2026-100229](https://cve.now/CVE-2026-100229.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst\_h266\_parser\_parse\_dci() due to off-by-one array bound check (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-88842](https://cve.now/CVE-2026-88842.md): Busybox: busybox: dpkg stale field\_start pointer causes out-of-bounds read and status file corruption (CVSS 3.3, Red Hat Hardened Images)
- [CVE-2026-109971](https://cve.now/CVE-2026-109971.md): Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool (CVSS 4.7, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-109970](https://cve.now/CVE-2026-109970.md): Clevis: clevis: pkcs#11 token pin written to world-readable file (CVSS 4.7, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-109969](https://cve.now/CVE-2026-109969.md): Clevis: clevis: no authentication on pkcs#11 af\_unix sockets allows key injection under permissive umask (CVSS 4.7, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-100231](https://cve.now/CVE-2026-100231.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-88829](https://cve.now/CVE-2026-88829.md): Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy (CVSS 7.2, Red Hat Hardened Images)
- [CVE-2026-90954](https://cve.now/CVE-2026-90954.md): Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush (CVSS 7.8, Red Hat Hardened Images)
- [CVE-2026-86476](https://cve.now/CVE-2026-86476.md): Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst\_video\_frame\_map\_id and video\_meta\_deserialize (CVSS 8.4, Red Hat Enterprise Linux)
- [CVE-2026-73794](https://cve.now/CVE-2026-73794.md): HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation (CVSS 4.6, Hewlett Packard Enterprise HPE NonStop MODULAR NSJ)
- [CVE-2026-73793](https://cve.now/CVE-2026-73793.md): HPE NonStop Middleware - Secret key handling vulnerability (CVSS 7.9, Hewlett Packard Enterprise HPE NonStop Middleware)
- [CVE-2026-73792](https://cve.now/CVE-2026-73792.md): HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability (CVSS 3.8, Hewlett Packard Enterprise HPE NonStop Java JToolkit)
- [CVE-2026-73791](https://cve.now/CVE-2026-73791.md): HPE NonStop Hpjmeter - Buffer overflow vulnerability (CVSS 2.0, Hewlett Packard Enterprise HPE NonStop Hpjmeter)
- [CVE-2026-73790](https://cve.now/CVE-2026-73790.md): HPE NonStop iTP WebServer - Memory corruption vulnerability (CVSS 8.2, Hewlett Packard Enterprise HPE NonStop iTP WebServer)
- [CVE-2026-14851](https://cve.now/CVE-2026-14851.md): Unauthorised disclosure of information on Copart’s online billing service (CVSS 9.2, Copart’s online billing service)
- [CVE-2026-103671](https://cve.now/CVE-2026-103671.md): External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". (CVSS 4.7, EC-CUBE CO. AmazonPay V2 Plugin · EC-CUBE CO. AmazonPay Plu…)
- [CVE-2026-107428](https://cve.now/CVE-2026-107428.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.5.12 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VideoWhisper.com Paid Videochat Turnkey Site)
- [CVE-2026-92392](https://cve.now/CVE-2026-92392.md): HTTP/2 upload Use-After-Free (CVSS 8.1, curl)
- [CVE-2026-107757](https://cve.now/CVE-2026-107757.md): Gallery Custom Links \<= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body (CVSS 4.9, tigroumeow Gallery Custom Links)
- [CVE-2026-104909](https://cve.now/CVE-2026-104909.md): Mang Board \<= 2.4.3 - Unauthenticated Local File Inclusion via '\<mode\>\_type' Parameter (CVSS 8.1, kitae-park Mang Board)
- [CVE-2026-104764](https://cve.now/CVE-2026-104764.md): Post Export Import with Media \<= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page\_data\[meta\]' Parameter (CVSS 7.2, wpazleen Post Export Import with Media)
- [CVE-2026-104748](https://cve.now/CVE-2026-104748.md): SimpleForm \<= 3.10.0 - Unauthenticated Privilege Escalation to wp\_capabilities Mass Assignment via simpleform\_wp\_register (CVSS 9.8, wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Po…)
- [CVE-2026-107650](https://cve.now/CVE-2026-107650.md): GeoDirectory \<= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-103907](https://cve.now/CVE-2026-103907.md): Jeg Kit for Elementor \<= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg\_find\_author' AJAX Action (CVSS 6.5, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2026-107631](https://cve.now/CVE-2026-107631.md): Record of Consent Extension for Complianz \<= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter (CVSS 7.2, davidevalerio Record of Consent Extension for Complianz)
- [CVE-2026-107751](https://cve.now/CVE-2026-107751.md): Mang Board \<= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user\_name' Parameter (CVSS 7.2, kitae-park Mang Board)
- [CVE-2026-107756](https://cve.now/CVE-2026-107756.md): Meow Lightbox \<= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display\_name (CVSS 6.4, tigroumeow Meow Lightbox)
- [CVE-2026-104761](https://cve.now/CVE-2026-104761.md): Mang Board \<= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter (CVSS 6.4, kitae-park Mang Board)
- [CVE-2026-110284](https://cve.now/CVE-2026-110284.md): LifterLMS \<= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms\_checkout' Shortcode Attributes (CVSS 7.5, LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes)
- [CVE-2026-103367](https://cve.now/CVE-2026-103367.md): ShopMagic \<= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first\_name' Parameter (CVSS 8.1, wpdesk ShopMagic – email automation for WordPress)
- [CVE-2025-9373](https://cve.now/CVE-2025-9373.md): PeproDev Branches Map \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, PeproDev Branches Map)
- [CVE-2026-103380](https://cve.now/CVE-2026-103380.md): Appointment Booking Plugin \<= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first\_name' Parameter Template Re-expansion (CVSS 4.3, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-103366](https://cve.now/CVE-2026-103366.md): Appointment Booking Plugin \<= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking\[id\]' and 'cart\[id\]' Parameters (CVSS 7.5, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-100163](https://cve.now/CVE-2026-100163.md): Appointment Booking Plugin \<= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create\_wp\_user\_for\_customer() username\_exists Fallback (CVSS 7.4, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-107754](https://cve.now/CVE-2026-107754.md): GeoDirectory \<= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-105107](https://cve.now/CVE-2026-105107.md): Koha SQL injection in reports/cat\_issues\_top.pl via the Criteria, Filter and Limit request parameters (CVSS 7.6, Koha Community Koha)
- [CVE-2026-105106](https://cve.now/CVE-2026-105106.md): Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task (CVSS 8.8, Koha Community Koha)
- [CVE-2026-110227](https://cve.now/CVE-2026-110227.md): WordPress Restricted Site Access plugin \<= 7.6.2 - Broken Access Control vulnerability (CVSS 5.3, 10up Restricted Site Access)
- [CVE-2026-109901](https://cve.now/CVE-2026-109901.md): WordPress CP Multi View Event Calendar plugin \<= 1.4.41 - SQL Injection vulnerability (CVSS 8.5, Codepeople CP Multi View Event Calendar)
- [CVE-2026-107171](https://cve.now/CVE-2026-107171.md): An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. (CVSS 6.9, Trellix Agent)
- [CVE-2026-89310](https://cve.now/CVE-2026-89310.md): SQL Command Injection Vulnerability in JTL-WMS (CVSS 9.4, JTL SW JTL-WMS)
- [CVE-2026-110467](https://cve.now/CVE-2026-110467.md): WisdomGarden｜Tronclass - Insecure Direct Object Reference (CVSS 5.3, WisdomGarden Tronclass)
- [CVE-2026-110466](https://cve.now/CVE-2026-110466.md): WisdomGarden｜Tronclass - Sensitive Data Exposure (CVSS 5.3, WisdomGarden Tronclass)
- [CVE-2026-110465](https://cve.now/CVE-2026-110465.md): WisdomGarden｜Tronclass - Insecure Direct Object Reference (CVSS 5.3, WisdomGarden Tronclass)
- [CVE-2026-96904](https://cve.now/CVE-2026-96904.md): AWP Classifieds \< 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page (CVSS 5.3, AWP Classifieds)
- [CVE-2026-96900](https://cve.now/CVE-2026-96900.md): Cart Abandonment Recovery for WooCommerce \< 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR (CVSS 5.3, Cart Abandonment Recovery for WooCommerce)
- [CVE-2026-94360](https://cve.now/CVE-2026-94360.md): Paymentfor Gateway for WooCommerce \< 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks (CVSS 5.3, Paymentfor Gateway for WooCommerce)
- [CVE-2026-94261](https://cve.now/CVE-2026-94261.md): Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id (CVSS 5.3, Sifalo Pay)
- [CVE-2026-94260](https://cve.now/CVE-2026-94260.md): Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure (CVSS 5.3, Sifalo Pay)
- [CVE-2026-94254](https://cve.now/CVE-2026-94254.md): SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit\_product\_prices' Parameter (CVSS 5.3, SellKit)
- [CVE-2026-92426](https://cve.now/CVE-2026-92426.md): YITH WooCommerce Popup \< 1.60.0 - Contributor+ Arbitrary Post Meta Deletion (CVSS 4.9, YITH WooCommerce Popup)
- [CVE-2026-92409](https://cve.now/CVE-2026-92409.md): Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode (CVSS 6.8, Donation Thermometer)
- [CVE-2026-91076](https://cve.now/CVE-2026-91076.md): Robokassa payment for WooCommerce \< 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed (CVSS 5.3, Robokassa payment gateway for Woocommerce)
- [CVE-2026-90989](https://cve.now/CVE-2026-90989.md): Tainacan \< 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints (CVSS 4.3, Tainacan)
- [CVE-2026-89288](https://cve.now/CVE-2026-89288.md): Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp\_order\_id' Parameter (CVSS 8.6, Fast Courier)
- [CVE-2026-88927](https://cve.now/CVE-2026-88927.md): rtMedia for WordPress, BuddyPress and bbPress \< 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR (CVSS 4.3, rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2026-87974](https://cve.now/CVE-2026-87974.md): Asaas Gateway for WooCommerce \< 2.7.8 - Unauthenticated Order Payment Bypass via Webhook (CVSS 5.3, Asaas Gateway for WooCommerce)
- [CVE-2026-87968](https://cve.now/CVE-2026-87968.md): Product Feed for Google Shopping \< 5.3.2 - Unauthenticated Forced Store Registration (CVSS 5.3, Product Feed for Google Shopping, Microsoft Advertising and…)
- [CVE-2026-87843](https://cve.now/CVE-2026-87843.md): Trust Payments Gateway for WooCommerce \< 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page (CVSS 6.5, Trust Payments Gateway for WooCommerce)
- [CVE-2026-86799](https://cve.now/CVE-2026-86799.md): Forms \< 3.0.2 - Unauthenticated Stored XSS via Form Submission (CVSS 8.8, Forms)
- [CVE-2026-86797](https://cve.now/CVE-2026-86797.md): Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link (CVSS 6.8, Pricing Table)
- [CVE-2026-86787](https://cve.now/CVE-2026-86787.md): Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive (CVSS 7.2, affiliate-toolkit)
- [CVE-2026-85345](https://cve.now/CVE-2026-85345.md): FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve\_video\_data (CVSS 4.1, FV Flowplayer Video Player)
- [CVE-2026-85000](https://cve.now/CVE-2026-85000.md): EmbedPress \< 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating (CVSS 5.3, EmbedPress)
- [CVE-2026-108069](https://cve.now/CVE-2026-108069.md): Sunshine Photo Cart \< 3.7.4 - Unauthenticated Content Injection via sunshine\_modal\_add\_comment() (CVSS 5.3, Sunshine Photo Cart)
- [CVE-2026-108066](https://cve.now/CVE-2026-108066.md): WP 2FA \< 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR (CVSS 2.7, WP 2FA)
- [CVE-2026-108064](https://cve.now/CVE-2026-108064.md): WP Encryption \< 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple\_auto\_handler (CVSS 6.5, WP Encryption)
- [CVE-2026-107594](https://cve.now/CVE-2026-107594.md): File Upload to Order \< 1.1.4 - Unauthenticated Arbitrary File Deletion (CVSS 10.0, File Upload to Order)
- [CVE-2026-107508](https://cve.now/CVE-2026-107508.md): Ultimate Multisite \< 2.17.2 - Unauthenticated LFI via 'attributes' Parameter (CVSS 8.6, Ultimate Multisite)
- [CVE-2026-107320](https://cve.now/CVE-2026-107320.md): GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure (CVSS 5.3, GamiPress)
- [CVE-2026-107319](https://cve.now/CVE-2026-107319.md): GamiPress \< 8.0.6 - Subscriber+ Activity Log Disclosure (CVSS 4.3, GamiPress)
- [CVE-2026-107178](https://cve.now/CVE-2026-107178.md): Image Photo Gallery Final Tiles Grid \< 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter (CVSS 6.8, Image Photo Gallery Final Tiles Grid)
- [CVE-2026-107160](https://cve.now/CVE-2026-107160.md): LTL Freight Quotes – Old Dominion Edition \< 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message (CVSS 5.3, LTL Freight Quotes)
- [CVE-2026-107158](https://cve.now/CVE-2026-107158.md): LTL Freight Quotes – Old Dominion Edition \< 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route (CVSS 5.3, LTL Freight Quotes)
- [CVE-2026-107126](https://cve.now/CVE-2026-107126.md): WP Booking System \< 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header (CVSS 8.8, WP Booking System)
- [CVE-2026-106646](https://cve.now/CVE-2026-106646.md): Classified Listing \< 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers (CVSS 5.9, Classified Listing)
- [CVE-2026-106469](https://cve.now/CVE-2026-106469.md): Gutenverse Form \< 3.0.11 - Contributor+ Stored XSS via SVG Icon (CVSS 6.8, Gutenverse Form)
- [CVE-2026-106166](https://cve.now/CVE-2026-106166.md): NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf\_set\_entry\_update\_id' Parameter (CVSS 5.3, NEX-Forms)
- [CVE-2026-106099](https://cve.now/CVE-2026-106099.md): WP Data Access \< 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export (CVSS 5.3, WP Data Access)
- [CVE-2026-106098](https://cve.now/CVE-2026-106098.md): WP Data Access \< 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update (CVSS 5.3, WP Data Access)
- [CVE-2026-105975](https://cve.now/CVE-2026-105975.md): CamPay Shortcode Payment Gateway \< 1.7 - Unauthenticated Payment Status Forgery via external\_reference (CVSS 5.3, CamPay Shortcode Payment Gateway)
- [CVE-2026-105969](https://cve.now/CVE-2026-105969.md): CodeAtoz B2B Suite for WooCommerce \< 1.6.1 - Unauthenticated Guest Quote Disclosure (CVSS 5.3, CodeAtoZ B2B Suite for WooCommerce)
- [CVE-2026-105261](https://cve.now/CVE-2026-105261.md): PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes (CVSS 6.8, Schedule Post Changes With PublishPress Future: Unpublish,…)
- [CVE-2026-104751](https://cve.now/CVE-2026-104751.md): Rank Math SEO \< 1.0.280 - Unauthenticated SEO Analyzer Results Deletion (CVSS 5.3, Rank Math SEO)
- [CVE-2026-104644](https://cve.now/CVE-2026-104644.md): Image Photo Gallery Final Tiles Grid \< 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update (CVSS 6.8, Image Photo Gallery Final Tiles Grid)
- [CVE-2026-103307](https://cve.now/CVE-2026-103307.md): Walletdoc Payment Gateway for WooCommerce \< 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook (CVSS 8.6, Walletdoc Payment Gateway for WooCommerce)
- [CVE-2026-94370](https://cve.now/CVE-2026-94370.md): Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs (CVSS 6.5, Qt\_for\_MCUs)
- [CVE-2026-110459](https://cve.now/CVE-2026-110459.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain (CVSS 8.6, Ubiquiti UniFi Protect AI Key)
- [CVE-2026-110458](https://cve.now/CVE-2026-110458.md): A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protec (CVSS 3.7, Ubiquiti UniFi Protect AI Key)
- [CVE-2026-107153](https://cve.now/CVE-2026-107153.md): Multiple smartphones provided by Rakuten Mobile, Inc. (CVSS 6.6, Rakuten Mobile Rakuten Mini · Rakuten Mobile Rakuten Hand +1)
- [CVE-2026-110457](https://cve.now/CVE-2026-110457.md): A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protec (CVSS 3.7, Ubiquiti UniFi Protect AI Key)
- [CVE-2026-110456](https://cve.now/CVE-2026-110456.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in Un (CVSS 5.3, Ubiquiti UniFi Protect AI Key)
- [CVE-2026-110455](https://cve.now/CVE-2026-110455.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in (CVSS 8.1, Ubiquiti UniFi Protect AI Key)
- [CVE-2026-110454](https://cve.now/CVE-2026-110454.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access (CVSS 5.3, Ubiquiti UniFi Protect AI Key)
- [CVE-2026-106931](https://cve.now/CVE-2026-106931.md): SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with… (CVSS 7.8, KEV, EG Secure Solutions SiteGuard Server Edition for Apache… +1)
- [CVE-2026-105429](https://cve.now/CVE-2026-105429.md): NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution (CVSS 8.9, NetBird)
- [CVE-2026-101926](https://cve.now/CVE-2026-101926.md): Hyyan WooCommerce Polylang Integration \<= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation\_ids' Parameter (CVSS 6.5, Hyyan WooCommerce Polylang Integration)
- [CVE-2026-103369](https://cve.now/CVE-2026-103369.md): Social Share Buttons & Analytics Plugin \<= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs\_update\_with\_values AJAX (CVSS 6.4, joaoromao Social Share Buttons & Analytics Plugin – GetSoci…)
- [CVE-2026-101924](https://cve.now/CVE-2026-101924.md): NewStatPress \<= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String (CVSS 7.2, ice00 NewStatPress)
- [CVE-2026-110453](https://cve.now/CVE-2026-110453.md): Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. (CVSS 4.3, NixOS Nix)
- [CVE-2026-110452](https://cve.now/CVE-2026-110452.md): The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it sh (CVSS 4.0, NixOS Nix)
- [CVE-2026-110451](https://cve.now/CVE-2026-110451.md): Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold (CVSS 4.3, NixOS Nix)
- [CVE-2026-110450](https://cve.now/CVE-2026-110450.md): Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store (CVSS 8.0, NixOS Nix)
- [CVE-2026-110449](https://cve.now/CVE-2026-110449.md): Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions bec (CVSS 7.5, NixOS Nix)
- [CVE-2026-100153](https://cve.now/CVE-2026-100153.md): NewStatPress \<= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) (CVSS 7.2, ice00 NewStatPress)
- [CVE-2026-87855](https://cve.now/CVE-2026-87855.md): JTL-Connector for WooCommerce \<= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method (CVSS 9.8, ntbyk JTL-Connector for WooCommerce)
- [CVE-2026-97471](https://cve.now/CVE-2026-97471.md): Avada (Fusion) Builder \<= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args\[link\_target\]' Parameter via {user\_meta} Dynamic Data Token (CVSS 5.3, themefusion Avada (Fusion) Builder)
- [CVE-2026-97398](https://cve.now/CVE-2026-97398.md): FV Flowplayer Video Player \<= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute (CVSS 7.2, foliovision FV Flowplayer Video Player)
- [CVE-2026-95808](https://cve.now/CVE-2026-95808.md): Form Maker by 10Web \<= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter (CVSS 7.5, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-100185](https://cve.now/CVE-2026-100185.md): Directorist: AI-Powered Business Directory, Listings & Classified Ads \<= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field (CVSS 6.4, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2026-83592](https://cve.now/CVE-2026-83592.md): Contact Form DB for Enfold \<= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values (CVSS 7.2, doctorwp Contact Form DB for Enfold)
- [CVE-2026-95816](https://cve.now/CVE-2026-95816.md): Smart Forms \<= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter (CVSS 7.2, edgarrojas Smart Forms – when you need more than just a con…)
- [CVE-2026-78193](https://cve.now/CVE-2026-78193.md): JTL-Connector for WooCommerce \<= 2.4.3 - Unauthenticated SQL Injection (CVSS 7.5, ntbyk JTL-Connector for WooCommerce)
- [CVE-2026-94377](https://cve.now/CVE-2026-94377.md): Verified Reviews (Avis Vérifiés) \<= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire) (CVSS 7.2, avisverifies Verified Reviews)
- [CVE-2026-97020](https://cve.now/CVE-2026-97020.md): PO/MO Editor \<= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter (CVSS 6.4, dougwollison PO/MO Editor)
- [CVE-2026-93885](https://cve.now/CVE-2026-93885.md): Cryptocurrency Donation Box \<= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data\_object Parameter (CVSS 7.2, blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto…)
- [CVE-2026-77114](https://cve.now/CVE-2026-77114.md): Document Gallery \<= 5.1.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, danrossiter Document Gallery)
- [CVE-2026-16495](https://cve.now/CVE-2026-16495.md): Countdown Timer – Widget Countdown \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect\_url' Shortcode Attribute (CVSS 6.4, wpdevart Countdown Timer – Widget Countdown)
- [CVE-2026-100193](https://cve.now/CVE-2026-100193.md): Tutor LMS \<= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter (CVSS 4.7, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-95807](https://cve.now/CVE-2026-95807.md): FV Player 8 \<= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute (CVSS 6.4, foliovision FV Player)
- [CVE-2026-104800](https://cve.now/CVE-2026-104800.md): AGE-GATE \<= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php (CVSS 9.8, streetforce1 AGE-GATE)
- [CVE-2026-96661](https://cve.now/CVE-2026-96661.md): Gmedia Photo Gallery \<= 1.25.1 - Unauthenticated SQL Injection via 'gmedia\_\_in' Parameter (CVSS 7.5, pasyuk Gmedia Photo Gallery)
- [CVE-2026-110445](https://cve.now/CVE-2026-110445.md): TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection (CVSS 8.6, TEAMPLUS TECHNOLOGY TeamPlus Messenger)
- [CVE-2026-110444](https://cve.now/CVE-2026-110444.md): TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection (CVSS 8.6, TEAMPLUS TECHNOLOGY TeamPlus Messenger)
- [CVE-2026-14765](https://cve.now/CVE-2026-14765.md): Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL (CVSS 7.7, Epic Games Unreal Engine)
- [CVE-2026-110447](https://cve.now/CVE-2026-110447.md): Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in… (CVSS 9.2, KEV, Collabora Online - Built-in CODE Server)
- [CVE-2026-103422](https://cve.now/CVE-2026-103422.md): AnyComment \<= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter (CVSS 7.2, ateshabaev AnyComment)
- [CVE-2026-97657](https://cve.now/CVE-2026-97657.md): Abandoned Cart Pro for WooCommerce \<= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter (CVSS 9.8, Tyche Softwares Abandoned Cart Pro for WooCommerce)
- [CVE-2026-102251](https://cve.now/CVE-2026-102251.md): Abandoned Cart Pro for WooCommerce \<= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter (CVSS 7.5, Tyche Softwares Abandoned Cart Pro for WooCommerce)
- [CVE-2026-97668](https://cve.now/CVE-2026-97668.md): Abandoned Cart Pro for WooCommerce \<= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta\_value (CVSS 9.8, Tyche Softwares Abandoned Cart Pro for WooCommerce)
- [CVE-2026-110002](https://cve.now/CVE-2026-110002.md): Snazzy Social Media Feed \<= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter (CVSS 9.8, snazzyplugins Snazzy Social Media Feed)
- [CVE-2026-82715](https://cve.now/CVE-2026-82715.md): Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server (CVSS 7.9, Hitachi Disk Array Driver for AIX · Hitachi Disk Array Driv…)
- [CVE-2026-86573](https://cve.now/CVE-2026-86573.md): Out-of-bounds Write Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server (CVSS 5.1, Hitachi Disk Array Driver for AIX · Hitachi Disk Array Driv…)
- [CVE-2026-86607](https://cve.now/CVE-2026-86607.md): Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator (CVSS 4.3, Hitachi Ops Center Administrator)
- [CVE-2026-110392](https://cve.now/CVE-2026-110392.md): Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning (CVSS 9.8, Samsung Open Source QA-Board)
- [CVE-2026-92097](https://cve.now/CVE-2026-92097.md): Click to Chat \<= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST\_URI via {url} Placeholder (CVSS 9.1, Click to Chat – HoliThemes)
- [CVE-2026-17092](https://cve.now/CVE-2026-17092.md): Directorist: AI-Powered Business Directory, Listings & Classified Ads \<= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing\_id' Parameter (CVSS 8.1, wpwax Directorist: AI-Powered Business Directory, Listings…)
- [CVE-2026-104995](https://cve.now/CVE-2026-104995.md): BP Profile Search \<= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps\_directory' Cookie 'ajax\_template' Value (CVSS 8.1, dontdream BP Profile Search)
- [CVE-2026-104767](https://cve.now/CVE-2026-104767.md): Membership & User Roles for WooCommerce (Automatic Role Changer) \<= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache (CVSS 7.5, davefx Membership & User Roles for WooCommerce)
- [CVE-2026-107652](https://cve.now/CVE-2026-107652.md): Database Addon for Contact Form 7 \<= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7\_file' Submission Field (CVSS 5.3, arshidkv12 Database Addon for Contact Form 7 – CFDB7)
- [CVE-2026-93388](https://cve.now/CVE-2026-93388.md): Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) \<= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner\_copy\_image\_from\_url (CVSS 9.8, Printcart Store – Web to Print Product Designer for WooComm…)
- [CVE-2026-104749](https://cve.now/CVE-2026-104749.md): Bit integrations \<= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data (CVSS 7.5, bitpressadmin Bit integrations – Form Integration, Webhook,…)
- [CVE-2026-103425](https://cve.now/CVE-2026-103425.md): Booking Package \<= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, masaakitanaka Booking Package)
- [CVE-2026-103423](https://cve.now/CVE-2026-103423.md): Booking Package \<= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0' (CVSS 7.5, masaakitanaka Booking Package)
- [CVE-2026-110385](https://cve.now/CVE-2026-110385.md): A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbo (CVSS 8.7, ONLYOFFICE Document Server)
- [CVE-2026-110359](https://cve.now/CVE-2026-110359.md): Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. (CVSS 7.8, Hyland Desktop Host)
- [CVE-2026-108473](https://cve.now/CVE-2026-108473.md): Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices (CVSS 8.7, TP-Link Systems HS103 · TP-Link Systems EP10 +22)
- [CVE-2026-46449](https://cve.now/CVE-2026-46449.md): The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptun (CVSS 6.7, Akamai Guardicore Platform Agent)
- [CVE-2026-50215](https://cve.now/CVE-2026-50215.md): A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. (CVSS 4.4, Akamai Guardicore Platform Agent)
- [CVE-2026-50216](https://cve.now/CVE-2026-50216.md): An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platfor (CVSS 5.3, Akamai Guardicore Platform Agent)
- [CVE-2026-50217](https://cve.now/CVE-2026-50217.md): A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged use (CVSS 4.7, Akamai Guardicore Platform Agent)
- [CVE-2026-50218](https://cve.now/CVE-2026-50218.md): Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. (CVSS 8.5, Akamai Guardicore Platform Agent)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.