# CVEs published 2026-10-16

474 CVEs were published on October 16, 2026: 52 critical, 175 high. Days are UTC.

- [CVE-2026-111823](https://cve.now/CVE-2026-111823.md): Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. (CVSS 9.8, mage-ai)
- [CVE-2026-89096](https://cve.now/CVE-2026-89096.md): Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd (CVSS 5.9, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-89088](https://cve.now/CVE-2026-89088.md): Parted: parted: denial of service via heap buffer overflow during fat16 resize (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-89085](https://cve.now/CVE-2026-89085.md): Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image (CVSS 6.6, Red Hat Enterprise Linux)
- [CVE-2026-110759](https://cve.now/CVE-2026-110759.md): Text::CSV\_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse (CVSS 9.8, Text-CSV\_XS)
- [CVE-2026-110758](https://cve.now/CVE-2026-110758.md): Text::CSV\_XS versions before 1.65 for Perl read before the start of an all-blank field under allow\_whitespace in strip\_trail\_whitespace (CVSS 7.5, Text-CSV\_XS)
- [CVE-2026-110757](https://cve.now/CVE-2026-110757.md): Text::CSV\_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine (CVSS 9.8, Text-CSV\_XS)
- [CVE-2026-110756](https://cve.now/CVE-2026-110756.md): Text::CSV\_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print (CVSS 9.8, Text-CSV\_XS)
- [CVE-2026-110755](https://cve.now/CVE-2026-110755.md): Text::CSV\_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline (CVSS 7.5, Text-CSV\_XS)
- [CVE-2026-110754](https://cve.now/CVE-2026-110754.md): Text::CSV\_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline (CVSS 6.5, Text-CSV\_XS)
- [CVE-2026-110753](https://cve.now/CVE-2026-110753.md): Text::CSV\_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind\_columns variables when skip\_empty\_rows skips an empty line in getline (CVSS 9.8, Text-CSV\_XS)
- [CVE-2026-110752](https://cve.now/CVE-2026-110752.md): Text::CSV\_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment (CVSS 7.5, Text-CSV\_XS)
- [CVE-2026-111802](https://cve.now/CVE-2026-111802.md): Nautilus: nautilus: arbitrary file deletion via trash symlink (CVSS 6.6, Red Hat Enterprise Linux)
- [CVE-2026-17591](https://cve.now/CVE-2026-17591.md): Libarchive: libarchive: use-after-free via aliased mac metadata copy (CVSS 3.6, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-111044](https://cve.now/CVE-2026-111044.md): Disabled Sunshine clients can bypass revocation with a derived client certificate (CVSS 7.6, LizardByte Sunshine)
- [CVE-2026-62438](https://cve.now/CVE-2026-62438.md): Gimp: gimp: paa integer overflow out-of-bounds read (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-62439](https://cve.now/CVE-2026-62439.md): Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2026-108372](https://cve.now/CVE-2026-108372.md): LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files (CVSS 7.1, huangruiteng loopx · loopx)
- [CVE-2026-49410](https://cve.now/CVE-2026-49410.md): OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation (CVSS 8.1, tinyhumansai openhuman)
- [CVE-2026-96627](https://cve.now/CVE-2026-96627.md): Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) (CVSS 8.8, getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1)
- [CVE-2026-68498](https://cve.now/CVE-2026-68498.md): jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service (CVSS 7.5, FasterXML jackson-core)
- [CVE-2026-96628](https://cve.now/CVE-2026-96628.md): Arcane: Environment access token bypasses the admin-required authorization gate on \`/api/debug/pprof\` (CVSS 4.3, getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1)
- [CVE-2026-96626](https://cve.now/CVE-2026-96626.md): Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host (CVSS 8.5, getarcaneapp arcane)
- [CVE-2026-96542](https://cve.now/CVE-2026-96542.md): EA Javelin Anticheat Installer Local Privilege Escalation (CVSS 5.0, Electronic Arts EA Javelin Anticheat)
- [CVE-2026-64862](https://cve.now/CVE-2026-64862.md): Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS (CVSS 6.5, frappe hrms)
- [CVE-2026-55796](https://cve.now/CVE-2026-55796.md): Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report (CVSS 6.5, frappe hrms)
- [CVE-2026-108373](https://cve.now/CVE-2026-108373.md): ERPNext: Unauthorised access to financial data due to missing validation (CVSS 6.5, frappe erpnext)
- [CVE-2026-108374](https://cve.now/CVE-2026-108374.md): ERPNext: Unauthorised status modification due to missing validation (CVSS 7.7, frappe erpnext)
- [CVE-2026-102834](https://cve.now/CVE-2026-102834.md): JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS (CVSS 7.5, bytedeco javacv · org.bytedeco:javacv)
- [CVE-2026-108743](https://cve.now/CVE-2026-108743.md): Apache Kylin: spark job OS command injection (CVSS 8.8, Apache Software Foundation Apache Kylin)
- [CVE-2026-96620](https://cve.now/CVE-2026-96620.md): Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution (CVSS 9.2, anthropics claude-agent-sdk-python · claude-agent-sdk)
- [CVE-2026-30971](https://cve.now/CVE-2026-30971.md): ZoneMinder: Authenticated RCE via command injection in monitor Device Path (CVSS 8.8, zoneminder)
- [CVE-2026-108709](https://cve.now/CVE-2026-108709.md): Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) (CVSS 9.8, Apache Software Foundation Apache Kylin)
- [CVE-2026-69080](https://cve.now/CVE-2026-69080.md): Apache Kylin: Broken Access Control in QuerySQLBlacklistController (CVSS 7.5, Apache Software Foundation Apache Kylin)
- [CVE-2026-102608](https://cve.now/CVE-2026-102608.md): ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download\_functions.php) (CVSS 9.0, zoneminder)
- [CVE-2026-69077](https://cve.now/CVE-2026-69077.md): Apache Kylin: JobController allows unauthorized cross-project manipulation (CVSS 7.5, Apache Software Foundation Apache Kylin)
- [CVE-2026-69076](https://cve.now/CVE-2026-69076.md): Apache Kylin: Unauthorized cross-project job discard (CVSS 7.5, Apache Software Foundation Apache Kylin)
- [CVE-2026-68573](https://cve.now/CVE-2026-68573.md): Apache Kylin: Unauthenticated Metastore Cleanup (CVSS 9.8, Apache Software Foundation Apache Kylin)
- [CVE-2026-68572](https://cve.now/CVE-2026-68572.md): Apache Kylin: Unauthorized SQL execution to Spark SQL env (CVSS 7.5, Apache Software Foundation Apache Kylin)
- [CVE-2026-102607](https://cve.now/CVE-2026-102607.md): ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature (CVSS 8.8, zoneminder)
- [CVE-2026-59970](https://cve.now/CVE-2026-59970.md): Tandoor Recipes: Blind SSRF via AI provider URL (api\_base) (CVSS 7.7, TandoorRecipes recipes)
- [CVE-2026-61726](https://cve.now/CVE-2026-61726.md): Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content (CVSS 8.1, TandoorRecipes recipes)
- [CVE-2026-59966](https://cve.now/CVE-2026-59966.md): Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns (CVSS 5.7, TandoorRecipes recipes)
- [CVE-2026-59963](https://cve.now/CVE-2026-59963.md): Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints (CVSS 7.1, TandoorRecipes recipes)
- [CVE-2026-17068](https://cve.now/CVE-2026-17068.md): IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System (CVSS 5.4, IBM i)
- [CVE-2026-17073](https://cve.now/CVE-2026-17073.md): IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System (CVSS 5.4, IBM i)
- [CVE-2026-17275](https://cve.now/CVE-2026-17275.md): IBM i is Affected by an Improper Validation Vulnerability (CVSS 3.7, IBM i)
- [CVE-2026-17488](https://cve.now/CVE-2026-17488.md): IBM i is Affected By An Improper Authentication Vulnerability in SST / DST (CVSS 4.3, IBM i)
- [CVE-2026-17491](https://cve.now/CVE-2026-17491.md): IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH (CVSS 5.4, IBM i)
- [CVE-2026-102917](https://cve.now/CVE-2026-102917.md): IBM i is Affected By An Improper Privilege Management Vulnerability (CVSS 7.8, IBM i)
- [CVE-2026-111793](https://cve.now/CVE-2026-111793.md): Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. (CVSS 4.3, Openwave Messaging (Ireland) Limited Webtop Media Transcoder)
- [CVE-2026-85977](https://cve.now/CVE-2026-85977.md): Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding (CVSS 5.3, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-85231](https://cve.now/CVE-2026-85231.md): Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec\_gss decoding (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-107674](https://cve.now/CVE-2026-107674.md): IBM i is Affected by a Denial of Service in Digital Certificate Manager (CVSS 5.1, IBM i)
- [CVE-2026-109838](https://cve.now/CVE-2026-109838.md): IBM Db2 Genius Hub Improper verification of cryptographic signature (CVSS 5.1, IBM Db2 Genius Hub)
- [CVE-2026-89098](https://cve.now/CVE-2026-89098.md): Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-111723](https://cve.now/CVE-2026-111723.md): LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API (CVSS 8.7, LingGuoAI LingGuo-Drama)
- [CVE-2026-111722](https://cve.now/CVE-2026-111722.md): LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API (CVSS 8.6, LingGuoAI LingGuo-Drama)
- [CVE-2026-111721](https://cve.now/CVE-2026-111721.md): Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping (CVSS 5.3, jingsewu open-wes)
- [CVE-2026-111720](https://cve.now/CVE-2026-111720.md): fish-island-backend through commit 7c61b78 SSRF via /api/web/parse (CVSS 6.9, lhccong fish-island-backend)
- [CVE-2026-111719](https://cve.now/CVE-2026-111719.md): Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query (CVSS 8.2, roncoo-pay)
- [CVE-2026-111718](https://cve.now/CVE-2026-111718.md): AipexBase through commit 690adb9 SQL Injection via /api/data/invoke (CVSS 7.1, kuafuai aipexbase)
- [CVE-2026-111717](https://cve.now/CVE-2026-111717.md): Arkon through 0.9.2 Missing Authorization via Skills Versions API (CVSS 5.3, nduckmink arkon)
- [CVE-2026-111716](https://cve.now/CVE-2026-111716.md): Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes (CVSS 5.3, nduckmink arkon)
- [CVE-2026-111715](https://cve.now/CVE-2026-111715.md): Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API (CVSS 5.3, nduckmink arkon)
- [CVE-2026-111714](https://cve.now/CVE-2026-111714.md): tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge (CVSS 2.3, AmauriC tarteaucitron.js)
- [CVE-2026-111713](https://cve.now/CVE-2026-111713.md): tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch (CVSS 5.1, AmauriC tarteaucitron.js)
- [CVE-2026-111712](https://cve.now/CVE-2026-111712.md): Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix (CVSS 6.9, Netcore NR256CN)
- [CVE-2026-111711](https://cve.now/CVE-2026-111711.md): Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user\_ok() (CVSS 9.3, Netcore NR256CN)
- [CVE-2026-111710](https://cve.now/CVE-2026-111710.md): Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS (CVSS 8.7, Netcore NR256CN)
- [CVE-2026-111709](https://cve.now/CVE-2026-111709.md): WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId (CVSS 5.3, canove whaticket-community)
- [CVE-2026-111708](https://cve.now/CVE-2026-111708.md): WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup (CVSS 9.3, canove whaticket-community)
- [CVE-2026-111707](https://cve.now/CVE-2026-111707.md): 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure (CVSS 6.9, vastxie 99AI)
- [CVE-2026-111706](https://cve.now/CVE-2026-111706.md): 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel (CVSS 8.7, vastxie 99AI)
- [CVE-2026-111705](https://cve.now/CVE-2026-111705.md): Fuint through commit 57ec018 IDOR via bookId in myBookDetail (CVSS 5.3, fushengqian fuint)
- [CVE-2026-111704](https://cve.now/CVE-2026-111704.md): LangChat through commit 2a6285a Missing Authentication on REST API Controllers (CVSS 9.3, langchat)
- [CVE-2026-111703](https://cve.now/CVE-2026-111703.md): yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints (CVSS 5.3, guchengwuyue yshop-crm)
- [CVE-2026-111702](https://cve.now/CVE-2026-111702.md): ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases (CVSS 8.7, sugarforever chat-ollama)
- [CVE-2026-81452](https://cve.now/CVE-2026-81452.md): Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. (CVSS 7.0, Dell Alienware Command Center)
- [CVE-2026-111701](https://cve.now/CVE-2026-111701.md): OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API (CVSS 8.3, OtterMind Nubase)
- [CVE-2026-111700](https://cve.now/CVE-2026-111700.md): WebVella ERP through 1.8.8 SQL Injection via EQL Query API (CVSS 7.1, WebVella-ERP)
- [CVE-2026-111699](https://cve.now/CVE-2026-111699.md): Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie (CVSS 6.3, niefy wx-api)
- [CVE-2026-111698](https://cve.now/CVE-2026-111698.md): HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge (CVSS 7.1, roinli HUIZHI-ChargeOS-cloud)
- [CVE-2026-111697](https://cve.now/CVE-2026-111697.md): HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs (CVSS 7.1, roinli HUIZHI-ChargeOS-cloud)
- [CVE-2026-111696](https://cve.now/CVE-2026-111696.md): data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords (CVSS 7.1, shaiwz data-platform-open)
- [CVE-2026-111695](https://cve.now/CVE-2026-111695.md): Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API (CVSS 7.1, shaiwz data-platform-open)
- [CVE-2026-111694](https://cve.now/CVE-2026-111694.md): qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints (CVSS 6.9, qiantongtech qKnow)
- [CVE-2026-111693](https://cve.now/CVE-2026-111693.md): DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials (CVSS 9.3, databufflabs databuff)
- [CVE-2026-111692](https://cve.now/CVE-2026-111692.md): DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret (CVSS 9.3, databufflabs databuff)
- [CVE-2026-111691](https://cve.now/CVE-2026-111691.md): WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header (CVSS 9.1, wimoor-erp wimoor)
- [CVE-2026-111690](https://cve.now/CVE-2026-111690.md): Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass (CVSS 9.3, suyuan32 simple-admin-core)
- [CVE-2026-111689](https://cve.now/CVE-2026-111689.md): XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint (CVSS 5.3, Exrick xboot)
- [CVE-2026-111688](https://cve.now/CVE-2026-111688.md): Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter (CVSS 5.3, Exrick xboot)
- [CVE-2026-111687](https://cve.now/CVE-2026-111687.md): WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint (CVSS 9.3, rachelos we-mp-rss)
- [CVE-2026-111686](https://cve.now/CVE-2026-111686.md): IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum (CVSS 8.7, Thecosy IceCMS)
- [CVE-2026-111685](https://cve.now/CVE-2026-111685.md): IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum (CVSS 8.7, Thecosy IceCMS)
- [CVE-2026-111684](https://cve.now/CVE-2026-111684.md): Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service (CVSS 7.2, absmach magistrala)
- [CVE-2026-111683](https://cve.now/CVE-2026-111683.md): Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API (CVSS 5.3, allegro ralph)
- [CVE-2026-111682](https://cve.now/CVE-2026-111682.md): EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys (CVSS 7.1, smartloli EFAK)
- [CVE-2026-111681](https://cve.now/CVE-2026-111681.md): EFAK through 5.1.0 Privilege Escalation via /api/users REST API (CVSS 8.7, smartloli EFAK)
- [CVE-2026-111680](https://cve.now/CVE-2026-111680.md): APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter (CVSS 7.2, APIParkLab APIPark)
- [CVE-2026-111679](https://cve.now/CVE-2026-111679.md): Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips (CVSS 5.3, EKKOLearnAI ekko-studio)
- [CVE-2026-111678](https://cve.now/CVE-2026-111678.md): Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing (CVSS 4.8, Adri van Os antiword)
- [CVE-2026-111677](https://cve.now/CVE-2026-111677.md): Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c (CVSS 6.8, Adri van Os antiword)
- [CVE-2026-111676](https://cve.now/CVE-2026-111676.md): Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint (CVSS 5.3, faveosuite faveo-helpdesk)
- [CVE-2026-111675](https://cve.now/CVE-2026-111675.md): Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover (CVSS 9.1, xiaochong0302 course-tencent-cloud)
- [CVE-2026-111674](https://cve.now/CVE-2026-111674.md): Tbed through 20240319 Missing Authorization via setImgFileName Endpoint (CVSS 5.3, Hello-hao Tbed)
- [CVE-2026-111673](https://cve.now/CVE-2026-111673.md): IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints (CVSS 9.3, Thecosy IceCMS)
- [CVE-2026-111672](https://cve.now/CVE-2026-111672.md): Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints (CVSS 5.3, data-infra cube-studio)
- [CVE-2026-111671](https://cve.now/CVE-2026-111671.md): Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints (CVSS 7.1, data-infra cube-studio)
- [CVE-2026-111670](https://cve.now/CVE-2026-111670.md): ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module (CVSS 5.3, clickvisual)
- [CVE-2026-111669](https://cve.now/CVE-2026-111669.md): ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY (CVSS 7.1, izhaorui Zr.Admin.NET)
- [CVE-2026-111668](https://cve.now/CVE-2026-111668.md): AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API (CVSS 5.3, beizhu-1209 AIHelms)
- [CVE-2026-111667](https://cve.now/CVE-2026-111667.md): REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint (CVSS 5.3, getrebuild rebuild)
- [CVE-2026-111666](https://cve.now/CVE-2026-111666.md): Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API (CVSS 5.3, steedos-platform)
- [CVE-2026-111665](https://cve.now/CVE-2026-111665.md): Piranha CMS through 12.2 Missing Authorization in Manager Language API (CVSS 5.3, PiranhaCMS Piranha CMS)
- [CVE-2026-111664](https://cve.now/CVE-2026-111664.md): Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url (CVSS 4.8, safing portmaster)
- [CVE-2026-111663](https://cve.now/CVE-2026-111663.md): Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation (CVSS 9.2, chaskiq)
- [CVE-2026-111662](https://cve.now/CVE-2026-111662.md): Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint (CVSS 6.9, chaskiq)
- [CVE-2026-111661](https://cve.now/CVE-2026-111661.md): waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint (CVSS 6.9, wayn111 waynboot-mall)
- [CVE-2026-111660](https://cve.now/CVE-2026-111660.md): waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid (CVSS 6.9, wayn111 waynboot-mall)
- [CVE-2026-111659](https://cve.now/CVE-2026-111659.md): Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit (CVSS 6.9, wayn111 waynboot-mall)
- [CVE-2026-111658](https://cve.now/CVE-2026-111658.md): SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API (CVSS 5.1, SiteServer SSCMS)
- [CVE-2026-111657](https://cve.now/CVE-2026-111657.md): BeikeShop through 2.0.0.31 IDOR via RMA mark\_as\_shipped Endpoint (CVSS 5.3, beikeshop)
- [CVE-2026-111656](https://cve.now/CVE-2026-111656.md): ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints (CVSS 5.3, zhimaAi chatwiki)
- [CVE-2026-111655](https://cve.now/CVE-2026-111655.md): ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit (CVSS 5.1, zoujingli think-plugs-admin)
- [CVE-2026-111654](https://cve.now/CVE-2026-111654.md): FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints (CVSS 5.3, kerwincui FastBee)
- [CVE-2026-111653](https://cve.now/CVE-2026-111653.md): 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id (CVSS 6.9, 53AIHub)
- [CVE-2026-111652](https://cve.now/CVE-2026-111652.md): Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment (CVSS 6.9, 3xxx engineercms)
- [CVE-2026-111651](https://cve.now/CVE-2026-111651.md): Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController (CVSS 7.1, risesoft-y9 Digital-Infrastructure)
- [CVE-2026-111650](https://cve.now/CVE-2026-111650.md): ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API (CVSS 8.8, HoshinoSuzumi chronoframe)
- [CVE-2026-111649](https://cve.now/CVE-2026-111649.md): Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint (CVSS 7.1, rocboss paopao-ce)
- [CVE-2026-111648](https://cve.now/CVE-2026-111648.md): BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter (CVSS 5.1, build-admin buildadmin)
- [CVE-2026-111647](https://cve.now/CVE-2026-111647.md): PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id} (CVSS 5.3, PickMall lilishop)
- [CVE-2026-111646](https://cve.now/CVE-2026-111646.md): SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview (CVSS 8.2, javahuang SurveyKing)
- [CVE-2026-111645](https://cve.now/CVE-2026-111645.md): MrDoc through 1.1.1 Missing Authorization via api/import\_local\_doc/ Endpoint (CVSS 5.3, zmister2016 MrDoc)
- [CVE-2026-111644](https://cve.now/CVE-2026-111644.md): Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes (CVSS 6.9, l429609201 misaka\_danmu\_server)
- [CVE-2026-111643](https://cve.now/CVE-2026-111643.md): Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback (CVSS 9.3, l429609201 misaka\_danmu\_server)
- [CVE-2026-111642](https://cve.now/CVE-2026-111642.md): FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation (CVSS 8.7, FastapiAdmin)
- [CVE-2026-111641](https://cve.now/CVE-2026-111641.md): FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints (CVSS 9.3, FastapiAdmin)
- [CVE-2026-111640](https://cve.now/CVE-2026-111640.md): DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs (CVSS 5.3, kuaifan dootask)
- [CVE-2026-111639](https://cve.now/CVE-2026-111639.md): bbs-go through 4.4.6 Account Takeover via Google One Tap Login (CVSS 8.6, mlogclub bbs-go)
- [CVE-2026-111638](https://cve.now/CVE-2026-111638.md): sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys (CVSS 8.3, moul sshportal)
- [CVE-2026-111637](https://cve.now/CVE-2026-111637.md): NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint (CVSS 6.9, Blair2004 NexoPOS)
- [CVE-2026-111636](https://cve.now/CVE-2026-111636.md): OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret (CVSS 9.2, OpenBMB StaffDeck)
- [CVE-2026-111635](https://cve.now/CVE-2026-111635.md): Helical Insight through 7.0.0 Path Traversal via /getExternalResource (CVSS 5.3, helicalinsight)
- [CVE-2026-111634](https://cve.now/CVE-2026-111634.md): Helical Insight through 7.0.0 SQL Injection via /executeDatasource (CVSS 8.6, helicalinsight)
- [CVE-2026-111633](https://cve.now/CVE-2026-111633.md): ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key (CVSS 8.8, SeriaWei ZKEACMS)
- [CVE-2026-111632](https://cve.now/CVE-2026-111632.md): Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company\_id (CVSS 5.3, aureuserp)
- [CVE-2026-111631](https://cve.now/CVE-2026-111631.md): Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions (CVSS 5.3, 10up Distributor)
- [CVE-2026-111630](https://cve.now/CVE-2026-111630.md): abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations (CVSS 5.3, colinin abp-next-admin)
- [CVE-2026-111629](https://cve.now/CVE-2026-111629.md): IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs (CVSS 5.3, IoTSharp)
- [CVE-2026-111628](https://cve.now/CVE-2026-111628.md): 10up Distributor before 2.3.2 PHP Object Injection via set\_meta() (CVSS 2.3, 10up Distributor)
- [CVE-2026-111627](https://cve.now/CVE-2026-111627.md): HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation (CVSS 8.6, hestiacp)
- [CVE-2026-111626](https://cve.now/CVE-2026-111626.md): Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers (CVSS 9.3, Webreaper Damselfly)
- [CVE-2026-111625](https://cve.now/CVE-2026-111625.md): 10up Distributor before 2.3.2 Missing Authorization via dt\_push AJAX Action (CVSS 5.3, 10up Distributor)
- [CVE-2026-111624](https://cve.now/CVE-2026-111624.md): Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs (CVSS 6.3, Umbraco-CMS)
- [CVE-2026-111623](https://cve.now/CVE-2026-111623.md): Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance (CVSS 6.3, joey-zhou xiaozhi-esp32-server-java)
- [CVE-2026-111622](https://cve.now/CVE-2026-111622.md): smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri (CVSS 7.6, a466350665 smart-sso)
- [CVE-2026-111621](https://cve.now/CVE-2026-111621.md): TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key} (CVSS 5.3, TDuckCloud tduck-survey-form)
- [CVE-2026-111620](https://cve.now/CVE-2026-111620.md): O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint (CVSS 6.0, O2OA)
- [CVE-2026-111619](https://cve.now/CVE-2026-111619.md): FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php (CVSS 7.1, zyx0814 FilePress)
- [CVE-2026-111618](https://cve.now/CVE-2026-111618.md): CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints (CVSS 6.9, coaidev CoAI)
- [CVE-2026-111617](https://cve.now/CVE-2026-111617.md): WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints (CVSS 6.9, MGdaasLab WHartTest)
- [CVE-2026-111616](https://cve.now/CVE-2026-111616.md): Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API (CVSS 6.9, Oqtane Framework)
- [CVE-2026-111615](https://cve.now/CVE-2026-111615.md): Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order\_addr Endpoint (CVSS 7.1, gz-yami mall4cloud)
- [CVE-2026-111614](https://cve.now/CVE-2026-111614.md): DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials (CVSS 7.1, devlive-community DataCap)
- [CVE-2026-111613](https://cve.now/CVE-2026-111613.md): AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test (CVSS 8.7, alldatacenter alldata)
- [CVE-2026-111612](https://cve.now/CVE-2026-111612.md): netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth (CVSS 8.7, qaiu netdisk-fast-download)
- [CVE-2026-111611](https://cve.now/CVE-2026-111611.md): roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints (CVSS 5.3, roncoo-education)
- [CVE-2026-111610](https://cve.now/CVE-2026-111610.md): B3log Solo through 4.4.0 Missing Authorization in ArticleConsole (CVSS 5.3, b3log Solo)
- [CVE-2026-111609](https://cve.now/CVE-2026-111609.md): PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription (CVSS 5.1, PKP Open Journal Systems)
- [CVE-2026-111608](https://cve.now/CVE-2026-111608.md): Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId} (CVSS 2.3, jeequan jeepay)
- [CVE-2026-111607](https://cve.now/CVE-2026-111607.md): Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs (CVSS 7.1, jeequan jeepay)
- [CVE-2026-111606](https://cve.now/CVE-2026-111606.md): Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC (CVSS 8.6, hcengineering Huly Platform)
- [CVE-2026-111605](https://cve.now/CVE-2026-111605.md): Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController (CVSS 8.6, dromara Jpom)
- [CVE-2026-111604](https://cve.now/CVE-2026-111604.md): eladmin through 2.7 Broken Access Control via /api/users Update and Delete (CVSS 5.1, elunez eladmin)
- [CVE-2026-111603](https://cve.now/CVE-2026-111603.md): PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints (CVSS 5.3, PlayEdu)
- [CVE-2026-111392](https://cve.now/CVE-2026-111392.md): SGLang through 0.5.21 KV Cache Poisoning via mm\_hashes in /generate (CVSS 6.3, sgl-project sglang)
- [CVE-2026-109839](https://cve.now/CVE-2026-109839.md): IBM Db2 Genius Hub Missing Cryptographic Step (CVSS 3.1, IBM Db2 Genius Hub)
- [CVE-2026-102552](https://cve.now/CVE-2026-102552.md): Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver (CVSS 5.9, FreeRTOS-Plus-TCP)
- [CVE-2026-102551](https://cve.now/CVE-2026-102551.md): Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling (CVSS 7.7, FreeRTOS-Plus-TCP)
- [CVE-2026-80092](https://cve.now/CVE-2026-80092.md): Microsoft Identity Web Elevation of Privilege Vulnerability (CVSS 5.3, microsoft-identity-web)
- [CVE-2026-109461](https://cve.now/CVE-2026-109461.md): Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability (CVSS 5.9, Microsoft Identity Client for NodeJS · @azure/msal-node)
- [CVE-2026-109588](https://cve.now/CVE-2026-109588.md): Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel (CVSS 8.8, FreeRTOS-Kernel)
- [CVE-2026-109587](https://cve.now/CVE-2026-109587.md): Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel (CVSS 8.8, FreeRTOS-Kernel)
- [CVE-2026-59962](https://cve.now/CVE-2026-59962.md): Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes (CVSS 6.5, TandoorRecipes recipes)
- [CVE-2026-59967](https://cve.now/CVE-2026-59967.md): Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport (CVSS 5.4, TandoorRecipes recipes)
- [CVE-2026-49868](https://cve.now/CVE-2026-49868.md): RIOT: DHCPv6 client \_parse\_reply() missing sub-option length check leads to size\_t underflow and unbounded OOB heap read (CVSS 9.8, RIOT-OS RIOT)
- [CVE-2026-102693](https://cve.now/CVE-2026-102693.md): RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID (CVSS 9.6, RIOT-OS RIOT)
- [CVE-2026-102692](https://cve.now/CVE-2026-102692.md): RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access (CVSS 9.1, RIOT-OS RIOT)
- [CVE-2026-62362](https://cve.now/CVE-2026-62362.md): PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint (CVSS 4.9, PBH-BTN PeerBanHelper)
- [CVE-2026-86047](https://cve.now/CVE-2026-86047.md): MariaDB: Insufficient quoting in mariadb-dump and SHOW commands (CVSS 7.7, MariaDB server · mariadb +2)
- [CVE-2026-85745](https://cve.now/CVE-2026-85745.md): MariaDB: Out-of-bound buffer read on in \`ST\_Area\` of a multipolygon. (CVSS 4.3, MariaDB server · mariadb +2)
- [CVE-2026-85748](https://cve.now/CVE-2026-85748.md): MariaDB: Use-after-free with a large number of SYS\_REFCURSOR's (CVSS 9.9, MariaDB server · mariadb +2)
- [CVE-2026-85746](https://cve.now/CVE-2026-85746.md): MariaDB: Out-of-bound buffer write on in \`ST\_AsText\` of nested GeometryCollections (CVSS 9.9, MariaDB server · mariadb +2)
- [CVE-2026-92262](https://cve.now/CVE-2026-92262.md): MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. (CVSS 9.9, MariaDB server · mariadb +2)
- [CVE-2026-97380](https://cve.now/CVE-2026-97380.md): MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges (CVSS 8.8, MariaDB server · mariadb +2)
- [CVE-2026-85985](https://cve.now/CVE-2026-85985.md): MariaDB: Unauthorized file access via CONNECT engine UDFs (CVSS 5.4, MariaDB server · mariadb +2)
- [CVE-2026-86009](https://cve.now/CVE-2026-86009.md): Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control (CVSS 8.2, Mailu)
- [CVE-2026-86008](https://cve.now/CVE-2026-86008.md): Mailu domain managers can take over higher-privileged accounts (CVSS 7.2, Mailu)
- [CVE-2026-57169](https://cve.now/CVE-2026-57169.md): Dockhand: Unauthenticated container exec via WebSocket upgrade (CVSS 9.6, Finsys dockhand)
- [CVE-2026-77474](https://cve.now/CVE-2026-77474.md): dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (CVSS 7.1, Dicklesworthstone destructive\_command\_guard)
- [CVE-2026-44977](https://cve.now/CVE-2026-44977.md): countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context (CVSS 9.0, countly-server)
- [CVE-2026-41582](https://cve.now/CVE-2026-41582.md): countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files (CVSS 7.5, countly-server)
- [CVE-2026-42270](https://cve.now/CVE-2026-42270.md): countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception (CVSS 7.5, countly-server)
- [CVE-2026-42269](https://cve.now/CVE-2026-42269.md): countly-server: Path Traversal in delete\_import Endpoint Allows Arbitrary File and Directory Deletion (CVSS 8.1, countly-server)
- [CVE-2026-102923](https://cve.now/CVE-2026-102923.md): SparkyFitness: SSRF via unvalidated custom\_url in AI service settings (CVSS 5.4, CodeWithCJ SparkyFitness)
- [CVE-2026-92263](https://cve.now/CVE-2026-92263.md): SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore (CVSS 7.2, CodeWithCJ SparkyFitness)
- [CVE-2026-68906](https://cve.now/CVE-2026-68906.md): libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU (CVSS 8.7, mz-automation libiec61850)
- [CVE-2026-68907](https://cve.now/CVE-2026-68907.md): libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils\_copyStringToBuffer arguments (CVSS 8.2, mz-automation libiec61850)
- [CVE-2026-68908](https://cve.now/CVE-2026-68908.md): libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path (CVSS 5.3, mz-automation libiec61850)
- [CVE-2026-57446](https://cve.now/CVE-2026-57446.md): libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE\* handle (CVSS 5.3, mz-automation libiec61850)
- [CVE-2026-48741](https://cve.now/CVE-2026-48741.md): libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS (CVSS 7.5, mz-automation libiec61850)
- [CVE-2026-48503](https://cve.now/CVE-2026-48503.md): libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead (CVSS 7.5, mz-automation libiec61850)
- [CVE-2026-111581](https://cve.now/CVE-2026-111581.md): Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method (CVSS 3.3, Red Hat Enterprise Linux)
- [CVE-2026-102941](https://cve.now/CVE-2026-102941.md): gomarkdown/markdown IsSafeURL panics on short URLs (CVSS 7.5, gomarkdown markdown · github.com/gomarkdown/markdown)
- [CVE-2026-77630](https://cve.now/CVE-2026-77630.md): pupnp: Denial of service via blocking DNS resolution in parse\_uri()/GENA callback parsing (CVSS 7.5, pupnp)
- [CVE-2026-96425](https://cve.now/CVE-2026-96425.md): Incorrect Permission Assignment for Critical Resource in lomiri-download-manager (CVSS 5.5, UBports lomiri-download-manager)
- [CVE-2026-96424](https://cve.now/CVE-2026-96424.md): Incorrect Permission Assignment for Critical Resource in lomiri-download-manager (CVSS 7.8, UBports lomiri-download-manager)
- [CVE-2026-57488](https://cve.now/CVE-2026-57488.md): pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling (CVSS 7.1, pupnp)
- [CVE-2026-57487](https://cve.now/CVE-2026-57487.md): libupnp chunked HTTP bodies can bypass g\_maxContentLength and be fully buffered (CVSS 7.5, pupnp)
- [CVE-2026-57486](https://cve.now/CVE-2026-57486.md): pupnp: NULL pointer dereference in ixmlNode\_compare crashes on non-namespaced attributes (CVSS 7.5, pupnp)
- [CVE-2026-55862](https://cve.now/CVE-2026-55862.md): pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow (CVSS 6.5, pupnp)
- [CVE-2026-57447](https://cve.now/CVE-2026-57447.md): Discourse Doc Categories: Doc category index refresh leaks private topic titles (CVSS 4.3, discourse-doc-categories)
- [CVE-2026-55543](https://cve.now/CVE-2026-55543.md): TuxGuitar: Arbitrary Code Execution via maliciously crafted \`.tg\` file (CVSS 8.5, helge17 tuxguitar)
- [CVE-2026-55836](https://cve.now/CVE-2026-55836.md): Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad) (CVSS 6.8, open-zaak)
- [CVE-2026-54657](https://cve.now/CVE-2026-54657.md): Open Zaak: /zaken/\_zoek and /enkelvoudiginformatieobjecten/\_zoek endpoints do not filter result lists based on authorizations linked to token (CVSS 6.5, open-zaak)
- [CVE-2026-95859](https://cve.now/CVE-2026-95859.md): libp2p-rust: Gossipsub GRAFT topics unbounded growth (CVSS 8.7, rust-libp2p)
- [CVE-2026-111728](https://cve.now/CVE-2026-111728.md): Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings (CVSS 5.3, 5rahim Seanime)
- [CVE-2026-107777](https://cve.now/CVE-2026-107777.md): Thermo Fisher Torrent Suite Software Path Traversal (CVSS 6.5, Thermo Fisher Torrent Suite Software)
- [CVE-2026-105667](https://cve.now/CVE-2026-105667.md): J4Care dcm4che Missing Authentication for Critical Function (CVSS 7.5, J4Care dcm4chee-arc-light)
- [CVE-2026-105279](https://cve.now/CVE-2026-105279.md): J4Care dcm4che Missing Authentication for Critical Function (CVSS 9.1, J4Care dcm4chee-arc-light)
- [CVE-2026-101021](https://cve.now/CVE-2026-101021.md): J4Care dcm4che Inefficient Algorithmic Complexity (CVSS 7.5, J4Care dcm4chee-arc-light)
- [CVE-2026-105273](https://cve.now/CVE-2026-105273.md): J4Care dcm4che Loop with Unreachable Exit Condition (CVSS 7.5, J4Care dcm4chee-arc-light)
- [CVE-2026-107621](https://cve.now/CVE-2026-107621.md): J4Care dcm4che Loop with Unreachable Exit Condition (CVSS 7.5, J4Care dcm4chee-arc-light)
- [CVE-2026-97851](https://cve.now/CVE-2026-97851.md): J4Care dcm4che Missing Authorization (CVSS 9.1, J4Care dcm4chee-arc-light)
- [CVE-2026-105664](https://cve.now/CVE-2026-105664.md): Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy (CVSS 5.3, Guangzhou Juan IoT Technology Co. EseeCloud App · Guangzhou…)
- [CVE-2026-97858](https://cve.now/CVE-2026-97858.md): Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVSS 5.3, Guangzhou Juan IoT Technology Co. EseeCloud App · Guangzhou…)
- [CVE-2026-107617](https://cve.now/CVE-2026-107617.md): Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials (CVSS 9.8, Guangzhou Juan IoT Technology Co. EseeCloud App · Guangzhou…)
- [CVE-2026-110805](https://cve.now/CVE-2026-110805.md): Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged u (CVSS 2.6, Devolutions Server)
- [CVE-2026-110804](https://cve.now/CVE-2026-110804.md): Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenti (CVSS 4.3, Devolutions Server)
- [CVE-2026-110806](https://cve.now/CVE-2026-110806.md): Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permis (CVSS 6.5, Devolutions Server)
- [CVE-2026-110287](https://cve.now/CVE-2026-110287.md): Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edi (CVSS 4.3, Devolutions Server)
- [CVE-2026-18516](https://cve.now/CVE-2026-18516.md): Improper Encoding or Escaping of Output in Crafty Controller (CVSS 9.6, Arcadia Technology Crafty Controller)
- [CVE-2026-90821](https://cve.now/CVE-2026-90821.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller (CVSS 5.4, Arcadia Technology Crafty Controller)
- [CVE-2026-97470](https://cve.now/CVE-2026-97470.md): Tourfic \<= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered\_html Grant to Customer Role (CVSS 6.4, themefic Tourfic – AI Powered Travel Booking, Hotel Booking…)
- [CVE-2026-111413](https://cve.now/CVE-2026-111413.md): WordPress aThemeArt theme Helper plugin \<= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, aThemeArt Theme Helper)
- [CVE-2026-110896](https://cve.now/CVE-2026-110896.md): WordPress Passster plugin \<= 4.3.18 - Broken Access Control vulnerability (CVSS 5.3, WP Chill Passster)
- [CVE-2026-107564](https://cve.now/CVE-2026-107564.md): gocsaf/csaf: csaf\_provider prone to uncontrolled resource consumption (CVSS 8.7, gocsaf Development Community csaf\_provider)
- [CVE-2026-111400](https://cve.now/CVE-2026-111400.md): WordPress PowerPack Addons for Elementor plugin \<= 3.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, IdeaBox Creations PowerPack Addons for Elementor)
- [CVE-2026-111396](https://cve.now/CVE-2026-111396.md): WordPress Advanced Post Manager plugin \<= 4.5.6 - Broken Access Control vulnerability (CVSS 7.1, Liquid Web / StellarWP Advanced Post Manager)
- [CVE-2026-111409](https://cve.now/CVE-2026-111409.md): WordPress YITH PayPal Express Checkout for WooCommerce plugin \<= 1.61.0 - Broken Access Control vulnerability (CVSS 5.3, YITH PayPal Express Checkout for WooCommerce)
- [CVE-2026-110903](https://cve.now/CVE-2026-110903.md): WordPress The Events Calendar plugin \<= 6.18.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-110900](https://cve.now/CVE-2026-110900.md): WordPress BookIt plugin \<= 2.6.0.5 - Broken Access Control vulnerability (CVSS 5.3, Liquid Web / StellarWP BookIt)
- [CVE-2026-110901](https://cve.now/CVE-2026-110901.md): WordPress SmartCrawl plugin \<= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, WPMU DEV SmartCrawl)
- [CVE-2026-110380](https://cve.now/CVE-2026-110380.md): WordPress WP Event Solution plugin \<= 4.1.26 - Broken Access Control vulnerability (CVSS 5.3, Arraytics WP Event Solution)
- [CVE-2026-111405](https://cve.now/CVE-2026-111405.md): WordPress MapSVG plugin \<= 8.16.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PT Norther Lights Production MapSVG)
- [CVE-2026-111399](https://cve.now/CVE-2026-111399.md): WordPress MapSVG plugin \<= 8.16.1 - SQL Injection vulnerability (CVSS 8.5, PT Norther Lights Production MapSVG)
- [CVE-2026-111397](https://cve.now/CVE-2026-111397.md): WordPress MapSVG plugin \<= 8.16.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, PT Norther Lights Production MapSVG)
- [CVE-2026-111555](https://cve.now/CVE-2026-111555.md): Luksmeta: missing slot-range validation permits out-of-gap device i/o (CVSS 6.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-105958](https://cve.now/CVE-2026-105958.md): Spice-server: spice: heap oob read/write via unchecked migration data offsets (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-68571](https://cve.now/CVE-2026-68571.md): Apache Kylin: JDBC URL Whitelist Verification Bypass (CVSS 8.8, Apache Software Foundation Apache Kylin)
- [CVE-2026-64959](https://cve.now/CVE-2026-64959.md): Apache Kylin: Missing authentication on certain cache API endpoints (CVSS 9.8, Apache Software Foundation Apache Kylin)
- [CVE-2026-64610](https://cve.now/CVE-2026-64610.md): Apache Kylin: Redis unsafe Java deserialization (CVSS 9.8, Apache Software Foundation Apache Kylin)
- [CVE-2026-63619](https://cve.now/CVE-2026-63619.md): Apache Kylin: Missing authorization and path-confinement on system meta dump (CVSS 9.1, Apache Software Foundation Apache Kylin)
- [CVE-2026-63618](https://cve.now/CVE-2026-63618.md): Apache Kylin: Low-Privilege Config Exposure (CVSS 7.5, Apache Software Foundation Apache Kylin)
- [RUSTSEC-2026-0391](https://cve.now/RUSTSEC-2026-0391.md): Data from an abandoned stream leaks into the next stream on a reused context (no CVSS, zstd)
- [RUSTSEC-2026-0392](https://cve.now/RUSTSEC-2026-0392.md): Uninitialized memory exposed by \`write::Decoder\` on a corrupt legacy frame (no CVSS, zstd)
- [RUSTSEC-2026-0393](https://cve.now/RUSTSEC-2026-0393.md): Out-of-bounds read when training a dictionary from inconsistent sample sizes (no CVSS, zstd)
- [RUSTSEC-2026-0395](https://cve.now/RUSTSEC-2026-0395.md): Use-after-free with \`CParameter::StableInBuffer\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0396](https://cve.now/RUSTSEC-2026-0396.md): \`Seekable\` reads a NULL or out-of-bounds seek table (no CVSS, zstd-safe)
- [RUSTSEC-2026-0397](https://cve.now/RUSTSEC-2026-0397.md): \`OutBuffer::around\_pos\` exposes uninitialized memory (no CVSS, zstd-safe)
- [RUSTSEC-2026-0398](https://cve.now/RUSTSEC-2026-0398.md): \`Seekable::decompress\` sets a \`Vec\` length beyond its capacity for offsets past the end (no CVSS, zstd-safe)
- [RUSTSEC-2026-0399](https://cve.now/RUSTSEC-2026-0399.md): Use-after-free through \`init\_using\_cdict\` and \`init\_using\_ddict\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0400](https://cve.now/RUSTSEC-2026-0400.md): Use-after-free of a dictionary after a one-shot call on a context with an open stream (no CVSS, zstd-safe)
- [RUSTSEC-2026-0401](https://cve.now/RUSTSEC-2026-0401.md): Out-of-bounds read in \`train\_from\_buffer\` when sample sizes overflow (no CVSS, zstd-safe)
- [RUSTSEC-2026-0402](https://cve.now/RUSTSEC-2026-0402.md): Heap buffer overflow in \`CCtx::try\_clone\` on a multithreaded context (no CVSS, zstd-safe)
- [RUSTSEC-2026-0403](https://cve.now/RUSTSEC-2026-0403.md): Uninitialized memory exposed when streaming decompression of a legacy frame fails (no CVSS, zstd-safe)
- [RUSTSEC-2026-0404](https://cve.now/RUSTSEC-2026-0404.md): Double free in \`DCtx::try\_clone\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0405](https://cve.now/RUSTSEC-2026-0405.md): Out-of-bounds read with an out-of-range \`InBuffer::pos\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0406](https://cve.now/RUSTSEC-2026-0406.md): Use-after-free when changing a multithreaded context with an unfinished frame (no CVSS, zstd-safe)
- [RUSTSEC-2026-0410](https://cve.now/RUSTSEC-2026-0410.md): WebAssembly allocator shim corrupts memory on allocation failure (no CVSS, zstd-sys)
- [CVE-2026-105959](https://cve.now/CVE-2026-105959.md): Spice-server: spice: heap buffer overflow via glz dictionary max\_encoders integer truncation (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-111391](https://cve.now/CVE-2026-111391.md): SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter (CVSS 9.2, sgl-project sglang)
- [CVE-2026-111390](https://cve.now/CVE-2026-111390.md): Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API (CVSS 6.0, erupts erupt)
- [CVE-2026-107648](https://cve.now/CVE-2026-107648.md): WP Sessions Time Monitoring Full Automatic \<= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter (CVSS 7.2, switcorp WP Sessions Time Monitoring Full Automatic)
- [CVE-2026-110029](https://cve.now/CVE-2026-110029.md): Squeeze \< 1.8.1 - Subscriber+ Missing Authorization via squeeze\_restore\_attachment (CVSS 5.4, Squeeze)
- [CVE-2026-109930](https://cve.now/CVE-2026-109930.md): MAIO \< 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key (CVSS 5.3, MAIO)
- [CVE-2026-109119](https://cve.now/CVE-2026-109119.md): Missing Authorization in rdiffweb (CVSS 8.8, ikus-soft rdiffweb)
- [CVE-2026-109118](https://cve.now/CVE-2026-109118.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb (CVSS 4.6, ikus-soft rdiffweb)
- [CVE-2026-14452](https://cve.now/CVE-2026-14452.md): Open redirect and XSS via reset\_url parameter (CVSS 8.6, Checkmk)
- [CVE-2026-106030](https://cve.now/CVE-2026-106030.md): Missing Authorization in NordVPN for Windows (CVSS 6.8, Nord Security NordVPN)
- [CVE-2026-107649](https://cve.now/CVE-2026-107649.md): Events Made Easy \<= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event\[location\_name\]' Parameter (CVSS 5.4, liedekef Events Made Easy)
- [CVE-2026-110703](https://cve.now/CVE-2026-110703.md): GeoDirectory \<= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post\_content' Parameter via data-embed-url Attribute (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-96768](https://cve.now/CVE-2026-96768.md): GoSMTP Pro \<= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body (CVSS 7.2, softaculous GoSMTP Pro)
- [CVE-2026-101300](https://cve.now/CVE-2026-101300.md): Server-Side Request Forgery in Wegow PDF export (CVSS 7.1, Wegow Technologies Wegow)
- [CVE-2026-15575](https://cve.now/CVE-2026-15575.md): Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier (CVSS 5.3, SFM Software Technologies Costifier)
- [CVE-2026-15219](https://cve.now/CVE-2026-15219.md): IDOR in SFM Software's Costifier (CVSS 6.5, SFM Software Technologies Costifier)
- [CVE-2026-111472](https://cve.now/CVE-2026-111472.md): SQL injection in TSG Profleet (CVSS 9.3, TSG Profleet)
- [CVE-2026-104003](https://cve.now/CVE-2026-104003.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \<= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab (CVSS 5.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-92766](https://cve.now/CVE-2026-92766.md): Vitepos \<= 3.5.1 - Unauthenticated SQL Injection via 'src\_by' Parameter (CVSS 7.5, appsbd Vitepos – Point of Sale (POS) for WooCommerce)
- [CVE-2026-104726](https://cve.now/CVE-2026-104726.md): Name Directory \<= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute (CVSS 6.4, jeroenpeters1986 Name Directory)
- [CVE-2026-109224](https://cve.now/CVE-2026-109224.md): SureCart \<= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment (CVSS 7.2, SureCart – Ecommerce Made Easy For Selling Physical Product…)
- [CVE-2026-93681](https://cve.now/CVE-2026-93681.md): Tutor LMS \<= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display\_name Parameter (CVSS 6.4, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-111311](https://cve.now/CVE-2026-111311.md): DoubleScale | All-in-One CRM \<= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint (CVSS 8.8, samuelgallegos DoubleScale CRM | All-in-One CRM – Sales, Mu…)
- [CVE-2026-14177](https://cve.now/CVE-2026-14177.md): User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure (CVSS 7.5, IKAS Technology ikas E-Commerce Infrastructure)
- [CVE-2026-96870](https://cve.now/CVE-2026-96870.md): SureDash \<= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display\_name' Parameter (CVSS 6.4, brainstormforce SureDash – Community, Courses & Member Dash…)
- [CVE-2026-100108](https://cve.now/CVE-2026-100108.md): Social Share Buttons \<= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share\_url' Network Setting (CVSS 6.4, maxfoundry Social Share Buttons)
- [CVE-2026-100106](https://cve.now/CVE-2026-100106.md): FiboSearch \<= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased\_plan' Parameter (CVSS 6.4, damian-gora FiboSearch – Ajax Search for WooCommerce)
- [CVE-2026-75903](https://cve.now/CVE-2026-75903.md): Vulnity Security \<= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials (CVSS 8.1, manuelgalan Vulnity Security)
- [CVE-2026-87111](https://cve.now/CVE-2026-87111.md): User Registration PRO \<= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header (CVSS 7.2, WPEverest User Registration PRO – Custom Registration Form,…)
- [CVE-2026-18799](https://cve.now/CVE-2026-18799.md): Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users (CVSS 4.3, Mattermost)
- [CVE-2026-16251](https://cve.now/CVE-2026-16251.md): Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering (CVSS 6.5, Mattermost)
- [CVE-2026-18256](https://cve.now/CVE-2026-18256.md): Private team metadata disclosure via the team search API (CVSS 4.3, Mattermost)
- [CVE-2026-18223](https://cve.now/CVE-2026-18223.md): Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access (CVSS 5.0, Mattermost)
- [CVE-2026-19076](https://cve.now/CVE-2026-19076.md): Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token (CVSS 4.4, Mattermost)
- [CVE-2026-18560](https://cve.now/CVE-2026-18560.md): Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status (CVSS 4.3, Mattermost)
- [CVE-2026-16453](https://cve.now/CVE-2026-16453.md): Mattermost SAML RelayState forgery allows unauthorized team membership (CVSS 7.1, Mattermost)
- [CVE-2026-19600](https://cve.now/CVE-2026-19600.md): Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts (CVSS 4.5, Mattermost)
- [CVE-2026-19621](https://cve.now/CVE-2026-19621.md): Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads (CVSS 6.5, Mattermost)
- [CVE-2026-19603](https://cve.now/CVE-2026-19603.md): Private channel ID disclosure via user status endpoints (CVSS 4.3, Mattermost)
- [CVE-2026-18795](https://cve.now/CVE-2026-18795.md): Missing server side validation allowed user to quarantine a DM and GM post (CVSS 6.4, Mattermost)
- [CVE-2026-94169](https://cve.now/CVE-2026-94169.md): WordPress The Grid plugin \<= 2.8.1 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, Theme-one The Grid)
- [CVE-2026-94388](https://cve.now/CVE-2026-94388.md): WordPress Green Popups plugin \< 7.6.3 - SQL Injection vulnerability (CVSS 9.3, halfdata Green Popups)
- [CVE-2026-97296](https://cve.now/CVE-2026-97296.md): WordPress Gravity Forms plugin \< 3.1.1 - PHP Object Injection vulnerability (CVSS 8.1, Rocketgenius Gravity Forms)
- [CVE-2026-96339](https://cve.now/CVE-2026-96339.md): WordPress Houzez theme \<= 4.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Houzez.co Houzez)
- [CVE-2026-19867](https://cve.now/CVE-2026-19867.md): Uncapped mention keys in user notification properties allow CPU exhaustion during post processing (CVSS 4.3, Mattermost)
- [CVE-2026-19601](https://cve.now/CVE-2026-19601.md): Disclosure of AD/LDAP bind password via Test Connection (CVSS 4.9, Mattermost)
- [CVE-2026-18551](https://cve.now/CVE-2026-18551.md): Mattermost guest account privilege escalation via member roles API (CVSS 6.5, Mattermost)
- [CVE-2026-19541](https://cve.now/CVE-2026-19541.md): Outgoing OAuth connection client secret exposure during connection validation (CVSS 6.5, Mattermost)
- [CVE-2026-110366](https://cve.now/CVE-2026-110366.md): WordPress Site Reviews plugin \<= 8.3.4 - Broken Access Control vulnerability (CVSS 5.3, Gemini Labs Site Reviews)
- [CVE-2026-104715](https://cve.now/CVE-2026-104715.md): Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass (CVSS 7.8, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-92115](https://cve.now/CVE-2026-92115.md): WP Photo Album Plus \<= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action (CVSS 8.8, opajaap WP Photo Album Plus)
- [CVE-2026-15222](https://cve.now/CVE-2026-15222.md): User Registration & Membership \<= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display\_name (CVSS 5.4, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-109401](https://cve.now/CVE-2026-109401.md): WP Mail Logging \<= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email (CVSS 2.7, smub WP Mail Logging)
- [CVE-2026-97640](https://cve.now/CVE-2026-97640.md): WPConsent \<= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) (CVSS 7.2, smub WPConsent – Cookie Banner & Cookie Consent for Privacy…)
- [CVE-2026-110252](https://cve.now/CVE-2026-110252.md): WPeMatico RSS Feed Fetcher \<= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import (CVSS 5.4, etruel WPeMatico RSS Feed Fetcher)
- [CVE-2026-109193](https://cve.now/CVE-2026-109193.md): HivePress \<= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value (CVSS 7.2, HivePress – Business Directory, Listings & Classified Ads P…)
- [CVE-2026-104730](https://cve.now/CVE-2026-104730.md): Sunshine Photo Cart \<= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter (CVSS 9.8, sunshinephotocart Sunshine Photo Cart – Client Photo Galler…)
- [CVE-2026-19798](https://cve.now/CVE-2026-19798.md): WP Map Block \<= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set\_status() and bulk() REST Endpoints (CVSS 4.3, tusharimran WP Map Block – Google Maps, OpenStreetMap, Mapb…)
- [CVE-2026-109382](https://cve.now/CVE-2026-109382.md): WSP MCP \<= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp\_get\_posts' MCP Tool (CVSS 6.5, bilalnaseer WSP MCP – Free MCP Plugin for WordPress: Connec…)
- [CVE-2026-104755](https://cve.now/CVE-2026-104755.md): WP Compress \<= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint (CVSS 4.8, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2026-107768](https://cve.now/CVE-2026-107768.md): TranslatePress \<= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers (CVSS 7.2, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-109388](https://cve.now/CVE-2026-109388.md): HivePress \<= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress\_user\_login\_form Shortcode (CVSS 6.4, HivePress – Business Directory, Listings & Classified Ads P…)
- [CVE-2026-110290](https://cve.now/CVE-2026-110290.md): WebberZone Top 10 \<= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other\_attributes' Block Attribute (CVSS 6.4, ajay WebberZone Top 10 — Popular Posts)
- [CVE-2026-92553](https://cve.now/CVE-2026-92553.md): YaySMTP \<= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension (CVSS 8.8, yaycommerce YaySMTP – WP Mail SMTP with Email Logs, Trackin…)
- [CVE-2026-111069](https://cve.now/CVE-2026-111069.md): GeoDirectory \<= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-107770](https://cve.now/CVE-2026-107770.md): Photo Engine (Media Organizer & Lightroom) \<= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action (CVSS 6.8, tigroumeow Photo Engine)
- [CVE-2026-110664](https://cve.now/CVE-2026-110664.md): Premium Packages \<= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes (CVSS 6.4, codename065 Premium Packages – Sell Digital Products Secure…)
- [CVE-2026-110701](https://cve.now/CVE-2026-110701.md): CP Multi View Events Calendar \<= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter (CVSS 7.2, codepeople CP Multi View Events Calendar)
- [CVE-2026-111178](https://cve.now/CVE-2026-111178.md): WP Booking System \<= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, murgroland WP Booking System – Booking Calendar)
- [CVE-2026-107646](https://cve.now/CVE-2026-107646.md): HUSKY \<= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof\_tm\_data' Localized Script (CVSS 5.3, realmag777 HUSKY – Products Filter for WooCommerce Professi…)
- [CVE-2026-110191](https://cve.now/CVE-2026-110191.md): Product Delivery Date for WooCommerce – Lite \< 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions (CVSS 2.7, Product Delivery Date for WooCommerce)
- [CVE-2026-110179](https://cve.now/CVE-2026-110179.md): affiliate-toolkit \< 3.8.9 - Editor+ SQL Injection via orderby Parameter (CVSS 6.8, affiliate-toolkit)
- [CVE-2026-110135](https://cve.now/CVE-2026-110135.md): OTP Login & Register Woocommerce \< 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force (CVSS 7.4, OTP Login & Register Woocommerce)
- [CVE-2026-110039](https://cve.now/CVE-2026-110039.md): Smush \< 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite (CVSS 2.7, Smush)
- [CVE-2026-110015](https://cve.now/CVE-2026-110015.md): Salon Booking System \< 10.31.9 - Administrator Account Creation via CSRF (CVSS 8.8, Salon Booking System)
- [CVE-2026-110014](https://cve.now/CVE-2026-110014.md): Salon Booking System \< 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status (CVSS 5.3, Salon Booking System)
- [CVE-2026-110013](https://cve.now/CVE-2026-110013.md): Salon Booking System \< 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token (CVSS 4.8, Salon Booking System)
- [CVE-2026-110012](https://cve.now/CVE-2026-110012.md): Salon Booking System \< 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming (CVSS 4.3, Salon Booking System)
- [CVE-2026-109982](https://cve.now/CVE-2026-109982.md): MB Custom Post Types & Custom Taxonomies \< 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration (CVSS 4.2, MB Custom Post Types & Custom Taxonomies)
- [CVE-2026-105974](https://cve.now/CVE-2026-105974.md): Visual Form Builder \<= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget (CVSS 4.3, Visual Form Builder)
- [CVE-2026-105973](https://cve.now/CVE-2026-105973.md): Visual Form Builder \<= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization (CVSS 4.3, Visual Form Builder)
- [CVE-2026-103696](https://cve.now/CVE-2026-103696.md): Mobile Builder \<= 1.4.2 - Unauthenticated SQLi via 'delivery\_id' Parameter (CVSS 6.8, Mobile builder)
- [CVE-2026-74923](https://cve.now/CVE-2026-74923.md): Document Gallery \<= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg\_generate\_gallery and dg\_generate\_icons (CVSS 5.3, Document Gallery)
- [CVE-2026-92427](https://cve.now/CVE-2026-92427.md): Coinsnap Bitcoin Crowdfunding \<= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure (CVSS 5.3, Coinsnap Bitcoin Crowdfunding)
- [CVE-2026-91830](https://cve.now/CVE-2026-91830.md): Subscribe to Comments \< 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie (CVSS 6.5, Subscribe to Comments)
- [CVE-2026-91833](https://cve.now/CVE-2026-91833.md): WX Subscribe \<= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter (CVSS 6.8, WX Subscribe 微信支付付费订阅)
- [CVE-2026-100186](https://cve.now/CVE-2026-100186.md): User Profile Builder \<= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field (CVSS 7.2, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2026-88963](https://cve.now/CVE-2026-88963.md): Tutor LMS \<= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect\_url' Parameter (CVSS 6.1, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-85659](https://cve.now/CVE-2026-85659.md): PilotPress \<= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter (CVSS 8.8, ontraport PilotPress)
- [CVE-2026-104932](https://cve.now/CVE-2026-104932.md): Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption (CVSS 8.0, johnny5 Search Regex)
- [CVE-2026-109513](https://cve.now/CVE-2026-109513.md): NotificationX \<= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route (CVSS 7.2, wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…)
- [CVE-2026-109414](https://cve.now/CVE-2026-109414.md): Vitepos \<= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src\_by\[\].val' Parameter via 'bt' Operator (CVSS 6.5, appsbd Vitepos – Point of Sale (POS) for WooCommerce)
- [CVE-2026-107764](https://cve.now/CVE-2026-107764.md): SiteOrigin CSS \<= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink (CVSS 7.2, gpriday SiteOrigin CSS)
- [CVE-2026-111122](https://cve.now/CVE-2026-111122.md): SiteOrigin CSS \<= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector (CVSS 7.2, gpriday SiteOrigin CSS)
- [CVE-2026-89051](https://cve.now/CVE-2026-89051.md): Hide My WP Ghost \<= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, johndarrel Hide My WP Ghost – Security & Firewall)
- [CVE-2026-103768](https://cve.now/CVE-2026-103768.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment (CVSS 9.8, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2026-109447](https://cve.now/CVE-2026-109447.md): User Profile Builder \<= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on \[wppb-register\] (CVSS 8.1, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2026-103896](https://cve.now/CVE-2026-103896.md): 10Web Booster \<= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path (CVSS 7.5, 10Web Booster – Website speed optimization, Cache & Page Sp…)
- [CVE-2026-109232](https://cve.now/CVE-2026-109232.md): Salon Booking System \<= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX (CVSS 7.2, wordpresschef Salon Booking System – Appointment Booking fo…)
- [CVE-2026-104001](https://cve.now/CVE-2026-104001.md): Slim SEO \<= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta (CVSS 5.4, rilwis Slim SEO – AI SEO Plugin, Lightweight, Fast & Automa…)
- [CVE-2026-95809](https://cve.now/CVE-2026-95809.md): Opti-Behavior \<= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country\_name' Location Parameter (CVSS 7.2, optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B…)
- [CVE-2026-12272](https://cve.now/CVE-2026-12272.md): Lightweight Cookie Notice \<= 1.19 - Sensitive Information Exposure via W3TC\_DYNAMIC\_SECURITY Constant (CVSS 5.3, daext Lightweight Cookie Notice – Cookie Banner for Cookie…)
- [CVE-2026-89079](https://cve.now/CVE-2026-89079.md): Theme My Login \<= 7.2.1 - Unauthenticated Privilege Escalation via 'user\_pass1' POST Parameter in wp\_pre\_insert\_user\_data Filter (CVSS 9.8, jfarthing84 Theme My Login)
- [CVE-2026-93767](https://cve.now/CVE-2026-93767.md): Tainacan \<= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter (CVSS 6.5, Tainacan)
- [CVE-2026-95686](https://cve.now/CVE-2026-95686.md): Opti-Behavior \<= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter (CVSS 7.2, optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B…)
- [CVE-2026-104000](https://cve.now/CVE-2026-104000.md): Simply Schedule Appointments \<= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id} (CVSS 7.2, croixhaug Simply Schedule Appointments)
- [CVE-2026-103480](https://cve.now/CVE-2026-103480.md): Tourfic \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute (CVSS 6.4, themefic Tourfic – AI Powered Travel Booking, Hotel Booking…)
- [CVE-2026-107748](https://cve.now/CVE-2026-107748.md): User Profile Builder \<= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display\_name' Parameter (CVSS 6.4, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2026-103999](https://cve.now/CVE-2026-103999.md): Ultra Addons for Contact Form 7 \<= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 7.2, themefic Ultra Addons for Contact Form)
- [CVE-2026-110017](https://cve.now/CVE-2026-110017.md): Quick PayPal Payments: Payment Button & Form \<= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute (CVSS 6.4, fullworks Quick PayPal Payments: Payment Button & Form)
- [CVE-2026-100158](https://cve.now/CVE-2026-100158.md): SQL Chart Builder \<= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field (CVSS 6.4, elvinhaci SQL Chart Builder)
- [CVE-2026-96570](https://cve.now/CVE-2026-96570.md): Schema & Structured Data for WP & AMP \<= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp\_review\_text' Parameter (CVSS 7.2, magazine3 Schema & Structured Data for WP & AMP)
- [CVE-2026-111458](https://cve.now/CVE-2026-111458.md): ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting (CVSS 6.8, adulau ssldump)
- [CVE-2026-109221](https://cve.now/CVE-2026-109221.md): Groundhogg \<= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy\_file' Field Mapping (CVSS 8.1, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-107659](https://cve.now/CVE-2026-107659.md): Modula Image Gallery \<= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT (CVSS 7.5, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2026-104798](https://cve.now/CVE-2026-104798.md): My Calendar \<= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute (CVSS 9.8, joedolson My Calendar – Accessible Event Manager)
- [CVE-2026-103481](https://cve.now/CVE-2026-103481.md): Gwolle Guestbook \<= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter (CVSS 6.1, mpol Gwolle Guestbook)
- [CVE-2026-110019](https://cve.now/CVE-2026-110019.md): Bulk Page Generator \<= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow (CVSS 4.3, niklaslindemann Bulk Page Generator – LPagery)
- [CVE-2026-110590](https://cve.now/CVE-2026-110590.md): Klarna for WooCommerce \<= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint (CVSS 7.5, klarnaplugin Klarna for WooCommerce)
- [CVE-2026-107746](https://cve.now/CVE-2026-107746.md): FunnelKit \<= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order\_id' / 'order' POST Parameter (CVSS 7.5, teamfunnelkit FunnelKit – Funnel Builder Plugin for WooComm…)
- [CVE-2026-111114](https://cve.now/CVE-2026-111114.md): Nexter Extension \<= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter (CVSS 7.5, posimyththemes Nexter Extension – Security, Performance, Co…)
- [CVE-2026-109998](https://cve.now/CVE-2026-109998.md): Mang Board \<= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content\_reply AJAX (CVSS 7.2, kitae-park Mang Board)
- [CVE-2026-103911](https://cve.now/CVE-2026-103911.md): Forminator Forms \<= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render\_block (CVSS 6.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-109191](https://cve.now/CVE-2026-109191.md): Image Hub \<= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML (CVSS 4.3, extendthemes Image Hub – Free Images from Unsplash, Pixabay…)
- [CVE-2026-109515](https://cve.now/CVE-2026-109515.md): MailOptin \<= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form\_custom\_field\_mappings' Parameter (CVSS 9.8, properfraction MailOptin – Popup, Optin Forms & Email Newsl…)
- [CVE-2026-109400](https://cve.now/CVE-2026-109400.md): InstaWP Connect \<= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp\_sync\_tab\_roles' Role-as-Capability Setting (CVSS 7.5, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2026-110721](https://cve.now/CVE-2026-110721.md): NotificationX \<= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx\_id' Parameter on /popup-submit REST Route (CVSS 5.3, wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…)
- [CVE-2026-103525](https://cve.now/CVE-2026-103525.md): FluentCart A New Era of eCommerce \<= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order\_id' and 'billing\_address\_id' Parameters (CVSS 7.5, wpmanageninja FluentCart A New Era of eCommerce – Faster, L…)
- [CVE-2026-111106](https://cve.now/CVE-2026-111106.md): Mail Mint \<= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter (CVSS 6.5, getwpfunnels Mail Mint – Email Marketing, Automation & WooC…)
- [CVE-2026-109512](https://cve.now/CVE-2026-109512.md): Mang Board \<= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter (CVSS 6.4, kitae-park Mang Board)
- [CVE-2026-103895](https://cve.now/CVE-2026-103895.md): miniOrange OTP Login, Verification and SMS Notifications \<= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State (CVSS 8.1, cyberlord92 miniOrange OTP Login, Verification and SMS Noti…)
- [CVE-2026-101335](https://cve.now/CVE-2026-101335.md): Forminator Forms \<= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer\_url' Parameter via Quiz Notification Merge Tags (CVSS 6.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-109219](https://cve.now/CVE-2026-109219.md): Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image\_path' Parameter (CVSS 9.8, kitae-park Mang Board)
- [CVE-2026-96562](https://cve.now/CVE-2026-96562.md): Broken Link Checker \<= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser\_callback (CVSS 6.5, wpmudev Broken Link Checker)
- [CVE-2026-111451](https://cve.now/CVE-2026-111451.md): Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. (CVSS 7.8, Wheels CLI)
- [CVE-2026-111450](https://cve.now/CVE-2026-111450.md): Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. (CVSS 5.9, Wheels)
- [CVE-2026-111449](https://cve.now/CVE-2026-111449.md): Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). (CVSS 5.9, Wheels)
- [CVE-2026-111448](https://cve.now/CVE-2026-111448.md): Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. (CVSS 3.7, Wheels)
- [CVE-2026-111447](https://cve.now/CVE-2026-111447.md): Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being sav (CVSS 8.1, Wheels)
- [CVE-2026-89280](https://cve.now/CVE-2026-89280.md): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \<= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id} (CVSS 4.3, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-107758](https://cve.now/CVE-2026-107758.md): Colibri Page Builder \<= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments (CVSS 7.2, extendthemes Colibri Page Builder)
- [CVE-2026-109207](https://cve.now/CVE-2026-109207.md): RSS Aggregator by Feedzy \<= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL (CVSS 7.2, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2026-104769](https://cve.now/CVE-2026-104769.md): Debloat \<= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed \<link\> (CVSS 5.9, asadkn Debloat – Remove Unused CSS, Optimize JS)
- [CVE-2026-104745](https://cve.now/CVE-2026-104745.md): Customer Email Verification for WooCommerce \<= 3.3.0 - Unauthenticated Privilege Escalation to 'alg\_wc\_ev\_verify\_email' Parameter (CVSS 8.1, wpcodefactory Customer Email Verification for WooCommerce)
- [CVE-2026-97339](https://cve.now/CVE-2026-97339.md): Complianz GDPR/CCPA Cookie Consent Banner \<= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter (CVSS 7.2, Complianz GDPR/CCPA Cookie Consent Banner)
- [CVE-2026-93953](https://cve.now/CVE-2026-93953.md): Backuply \<= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation (CVSS 8.0, softaculous Backuply – Backup, Restore, Migrate and Clone)
- [CVE-2026-109990](https://cve.now/CVE-2026-109990.md): Flying Scripts: Delay JavaScript to Improve Site Speed & Performance \<= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, gijo Flying Scripts: Delay JavaScript to Improve Site Speed…)
- [CVE-2026-103518](https://cve.now/CVE-2026-103518.md): FluentCart A New Era of eCommerce \<= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys (CVSS 4.9, wpmanageninja FluentCart A New Era of eCommerce – Faster, L…)
- [CVE-2026-77829](https://cve.now/CVE-2026-77829.md): Cooked \<= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via \[cooked-timer\] Shortcode Content (CVSS 6.4, goratech Cooked – Recipe Management)
- [CVE-2026-93535](https://cve.now/CVE-2026-93535.md): WP Dark Mode – Improve Accessibility with AI Powered Dark Theme \<= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon\_light' Shortcode Attribute (CVSS 6.4, wppool Dark Mode – Improve Accessibility with AI Powered Da…)
- [CVE-2026-111446](https://cve.now/CVE-2026-111446.md): Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/\* to remote clients when enablePublicComponent=true, as it (CVSS 8.6, Wheels)
- [CVE-2026-111445](https://cve.now/CVE-2026-111445.md): Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). (CVSS 8.1, Wheels)
- [CVE-2026-111444](https://cve.now/CVE-2026-111444.md): Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO\_BACKSLASH\_ESCAPES absent) when an application (CVSS 9.8, Wheels)
- [CVE-2026-111443](https://cve.now/CVE-2026-111443.md): Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production (CVSS 6.5, Wheels)
- [CVE-2026-111442](https://cve.now/CVE-2026-111442.md): Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack poten (CVSS 5.3, BackdropCMS Backdrop)
- [CVE-2026-109813](https://cve.now/CVE-2026-109813.md): Shared Hard-coded Root CA Private Key (CVSS 8.6, Moxa AIG-302 Series)
- [CVE-2026-109812](https://cve.now/CVE-2026-109812.md): Missing Authorization on Secret Endpoints (CVSS 6.9, Moxa AIG-302 Series)
- [CVE-2026-100159](https://cve.now/CVE-2026-100159.md): Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers (CVSS 4.8, ays-pro Popup Box – Create Countdown, Coupon, Video, Contac…)
- [CVE-2026-105228](https://cve.now/CVE-2026-105228.md): ISPSoft Out-of-Bounds Read Vulnerability (CVSS 7.0, Deltaww ISPSoft)
- [CVE-2026-105227](https://cve.now/CVE-2026-105227.md): ISPSoft Out-of-Bounds Read Vulnerability (CVSS 7.0, Deltaww ISPSoft)
- [CVE-2026-111389](https://cve.now/CVE-2026-111389.md): Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation (CVSS 8.3, frappe hrms)
- [CVE-2026-111388](https://cve.now/CVE-2026-111388.md): Frappe before 16.33.0 restrict\_ip Allowlist Bypass via API Key, OAuth Authentication (CVSS 5.3, frappe)
- [CVE-2026-111387](https://cve.now/CVE-2026-111387.md): Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint (CVSS 7.1, nezhahq nezha)
- [CVE-2026-111386](https://cve.now/CVE-2026-111386.md): Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig (CVSS 5.3, nezhahq nezha)
- [CVE-2026-111385](https://cve.now/CVE-2026-111385.md): Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools (CVSS 6.3, nezhahq nezha)
- [CVE-2026-111384](https://cve.now/CVE-2026-111384.md): Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket (CVSS 7.1, nezhahq nezha)
- [CVE-2026-111383](https://cve.now/CVE-2026-111383.md): Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket (CVSS 7.1, nezhahq nezha)
- [CVE-2026-111382](https://cve.now/CVE-2026-111382.md): FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine (CVSS 8.7, FreeRDP)
- [CVE-2026-111381](https://cve.now/CVE-2026-111381.md): FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser (CVSS 7.0, FreeRDP)
- [CVE-2026-111380](https://cve.now/CVE-2026-111380.md): FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends (CVSS 8.7, FreeRDP)
- [CVE-2026-111379](https://cve.now/CVE-2026-111379.md): FreeRDP before 3.32.0 Heap Buffer Overflow via persistent\_cache\_read\_entry\_v3 (CVSS 7.0, FreeRDP)
- [CVE-2026-111378](https://cve.now/CVE-2026-111378.md): FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser (CVSS 8.7, FreeRDP)
- [CVE-2026-111377](https://cve.now/CVE-2026-111377.md): FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly (CVSS 7.1, FreeRDP)
- [CVE-2026-111376](https://cve.now/CVE-2026-111376.md): FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS\_SIZE (CVSS 2.3, FreeRDP)
- [CVE-2026-111375](https://cve.now/CVE-2026-111375.md): FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title (CVSS 6.3, FreeRDP)
- [CVE-2026-111374](https://cve.now/CVE-2026-111374.md): FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest (CVSS 6.0, FreeRDP)
- [CVE-2026-111373](https://cve.now/CVE-2026-111373.md): FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping (CVSS 6.9, FreeRDP)
- [CVE-2026-111237](https://cve.now/CVE-2026-111237.md): Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get\_modelmeta.custom\_metadata\_map eval injection (CVSS 4.8, Ultralytics FastSAM)
- [CVE-2026-111212](https://cve.now/CVE-2026-111212.md): ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get\_modelmeta.custom\_metadata\_map eval injection (CVSS 2.4, ImprintLab Medical-SAM-Adapter)
- [CVE-2026-111210](https://cve.now/CVE-2026-111210.md): bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery (CVSS 6.9, bitcoinj)
- [CVE-2025-52097](https://cve.now/CVE-2025-52097.md): Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting u (CVSS 5.4)
- [CVE-2025-55640](https://cve.now/CVE-2025-55640.md): A heap buffer overflow in the stbl\_AddSize function (isomedia/stbl\_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Servic (CVSS 5.5)
- [CVE-2025-55653](https://cve.now/CVE-2025-55653.md): GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf\_parse\_lfrac function (utils/error.c). (CVSS 5.5)
- [CVE-2025-66969](https://cve.now/CVE-2025-66969.md): Integer overflow in OpenModSim (\<=1.11.0), leading to denial of service (CVSS 7.5)
- [CVE-2026-106705](https://cve.now/CVE-2026-106705.md): ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. (CVSS 8.8)
- [CVE-2026-26846](https://cve.now/CVE-2026-26846.md): Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510\_20251022 allows a remote attacker to execute arbitrary code via the Ut (CVSS 9.8)
- [CVE-2026-46471](https://cve.now/CVE-2026-46471.md): An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (CVSS 5.5)
- [CVE-2026-46472](https://cve.now/CVE-2026-46472.md): An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (CVSS 7.5)
- [CVE-2026-88755](https://cve.now/CVE-2026-88755.md): Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace conf (CVSS 7.8)
- [CVE-2026-95182](https://cve.now/CVE-2026-95182.md): An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening craf (CVSS 10.0)
- [CVE-2026-95183](https://cve.now/CVE-2026-95183.md): An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack v (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.