# CVEs published 2026-10-19

440 CVEs were published on October 19, 2026: 30 critical, 131 high. Days are UTC.

- [CVE-2026-105453](https://cve.now/CVE-2026-105453.md): IBM Sterling Connect:Direct for Unix Improper Privilege Management (CVSS 8.4, IBM Sterling Connect Direct for Unix)
- [CVE-2026-107366](https://cve.now/CVE-2026-107366.md): Langflow OSS Authorization Bypass Through User-Controlled Key (CVSS 8.3, IBM Langflow OSS)
- [CVE-2026-107400](https://cve.now/CVE-2026-107400.md): Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication (CVSS 8.8, IBM TRIRIGA Application Platform)
- [CVE-2026-109126](https://cve.now/CVE-2026-109126.md): IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials (CVSS 8.8, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-8355](https://cve.now/CVE-2026-8355.md): IBM ContextForge MCP Gateway is affected by server-side request forgery (CVSS 5.4, IBM ContextForge MCP Gateway)
- [CVE-2026-112373](https://cve.now/CVE-2026-112373.md): H3C Magic NX15 usrlist sub\_416874 stack-based overflow (CVSS 7.1, H3C Magic NX15)
- [CVE-2025-36061](https://cve.now/CVE-2025-36061.md): TS4500 Tape Library Denial of Service (CVSS 6.5, IBM Storage TS4500 Library)
- [CVE-2025-36069](https://cve.now/CVE-2025-36069.md): TS4500 Tape Library Insufficient Session Expiration (CVSS 5.5, IBM Storage TS4500 Library)
- [CVE-2025-36252](https://cve.now/CVE-2025-36252.md): TS4500 Tape Library Insufficient Session Expiration (CVSS 6.3, IBM Storage TS4500 Library)
- [CVE-2026-19178](https://cve.now/CVE-2026-19178.md): TS4500 Tape Library Race Condition (CVSS 6.8, IBM Storage TS4500 Library)
- [CVE-2026-77684](https://cve.now/CVE-2026-77684.md): Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service (CVSS 5.7, zephyrproject zephyr)
- [CVE-2026-19595](https://cve.now/CVE-2026-19595.md): Zephyr RTIO syscall verifier validates output parameters for read instead of write access (CVSS 6.1, zephyrproject zephyr)
- [CVE-2026-112372](https://cve.now/CVE-2026-112372.md): H3C Magic NX15 upload importprofile path traversal (CVSS 5.1, H3C Magic NX15)
- [CVE-2026-112371](https://cve.now/CVE-2026-112371.md): H3C Magic NX15 RPC esps write code injection (CVSS 9.4, H3C Magic NX15)
- [CVE-2026-112991](https://cve.now/CVE-2026-112991.md): MISP html\_to\_markdown Module SSRF via Incomplete IP Range Blocking in is\_safe\_url() (CVSS 6.3, misp-modules)
- [CVE-2026-112370](https://cve.now/CVE-2026-112370.md): H3C Magic NX15 usrlist sub\_416874 os command injection (CVSS 9.4, H3C Magic NX15)
- [CVE-2026-112901](https://cve.now/CVE-2026-112901.md): Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes (CVSS 6.9, python-pillow Pillow · pillow)
- [CVE-2026-112900](https://cve.now/CVE-2026-112900.md): Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (CVSS 9.2, python-pillow Pillow · pillow)
- [CVE-2026-112898](https://cve.now/CVE-2026-112898.md): Pillow: Image.quantize() with empty palette leaks uninitialized stack memory (CVSS 6.9, python-pillow Pillow · pillow)
- [CVE-2026-112897](https://cve.now/CVE-2026-112897.md): Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112896](https://cve.now/CVE-2026-112896.md): Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (CVSS 8.8, python-pillow Pillow · pillow)
- [CVE-2026-112895](https://cve.now/CVE-2026-112895.md): Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112894](https://cve.now/CVE-2026-112894.md): Pillow: Quadratic-time DoS in PDF save\_all (PdfParser.next\_object\_id) (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112893](https://cve.now/CVE-2026-112893.md): Pillow: Invalid free in FreeType glyph rendering when a stroker is active (CVSS 8.2, python-pillow Pillow · pillow)
- [CVE-2026-112361](https://cve.now/CVE-2026-112361.md): Dolibarr CSP document.php protection mechanism (CVSS 5.3, Dolibarr)
- [CVE-2026-112261](https://cve.now/CVE-2026-112261.md): Gimp: gimp: use-after-free in xcf loader via prop\_selected\_path (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-112258](https://cve.now/CVE-2026-112258.md): Gimp: gimp: use-after-free in xcf loader via prop\_linked and prop\_selection on channels (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-112257](https://cve.now/CVE-2026-112257.md): Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load\_resource\_1033) (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-112892](https://cve.now/CVE-2026-112892.md): Pillow: MSP RLE decoder expands a tiny file into unbounded memory (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112891](https://cve.now/CVE-2026-112891.md): Pillow: Quadratic GIF comment copying during save (CVSS 6.9, python-pillow Pillow · pillow)
- [CVE-2026-112406](https://cve.now/CVE-2026-112406.md): Pillow: Infinite loop in PdfParser.rewrite\_pages on page tree Parent cycle (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112360](https://cve.now/CVE-2026-112360.md): Netis EAP930 CGI Endpoint debug return200 backdoor (CVSS 8.9, Netis EAP930)
- [CVE-2026-112405](https://cve.now/CVE-2026-112405.md): Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112404](https://cve.now/CVE-2026-112404.md): Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels (CVSS 8.8, python-pillow Pillow · pillow)
- [CVE-2026-105815](https://cve.now/CVE-2026-105815.md): Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210 (CVSS 7.1, TP-Link Systems Tapo C210)
- [CVE-2026-105814](https://cve.now/CVE-2026-105814.md): Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210 (CVSS 5.3, TP-Link Systems Tapo C210)
- [CVE-2026-112403](https://cve.now/CVE-2026-112403.md): Pillow: Heap buffer overflow in ImagingJpegDecode (CVSS 9.2, python-pillow Pillow · pillow)
- [CVE-2026-112402](https://cve.now/CVE-2026-112402.md): Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112397](https://cve.now/CVE-2026-112397.md): Pillow: Out-of-bounds access in \_imagingmorph on a zero-width image (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112392](https://cve.now/CVE-2026-112392.md): Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images (CVSS 8.2, python-pillow Pillow · pillow)
- [CVE-2026-112401](https://cve.now/CVE-2026-112401.md): Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() (CVSS 6.9, python-pillow Pillow · pillow)
- [CVE-2026-112358](https://cve.now/CVE-2026-112358.md): TiBillet Lespass APIv1 serializers.py get\_img\_from\_url server-side request forgery (CVSS 2.1, TiBillet Lespass)
- [CVE-2026-112400](https://cve.now/CVE-2026-112400.md): Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112399](https://cve.now/CVE-2026-112399.md): Pillow: APNG background disposal allocates full canvas before decompression bomb check (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-112398](https://cve.now/CVE-2026-112398.md): Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVSS 9.2, python-pillow Pillow · pillow)
- [CVE-2026-53995](https://cve.now/CVE-2026-53995.md): MLflow 3.17.1 and prior Path Traversal via Trace ID API (CVSS 8.8, mlflow)
- [CVE-2026-112396](https://cve.now/CVE-2026-112396.md): Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer (CVSS 5.9, python-pillow Pillow · pillow)
- [CVE-2026-112302](https://cve.now/CVE-2026-112302.md): kiwilan php-archive Extraction ArchiveZip.php extract path traversal (CVSS 5.3, kiwilan php-archive)
- [CVE-2026-112395](https://cve.now/CVE-2026-112395.md): Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) (CVSS 6.5, python-pillow Pillow · pillow)
- [CVE-2026-111946](https://cve.now/CVE-2026-111946.md): Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header (CVSS 5.3, Plack-Middleware-ETag)
- [CVE-2026-112394](https://cve.now/CVE-2026-112394.md): Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (CVSS 6.3, python-pillow Pillow · pillow)
- [CVE-2026-112393](https://cve.now/CVE-2026-112393.md): Pillow: Heap buffer overflow in \_tiffWriteProc when saving TIFF to BytesIO (CVSS 9.2, python-pillow Pillow · pillow)
- [CVE-2026-112301](https://cve.now/CVE-2026-112301.md): orbitale imagemagick-php Command.php font os command injection (CVSS 6.9, orbitale imagemagick-php)
- [CVE-2026-112391](https://cve.now/CVE-2026-112391.md): Pillow: PdfParser can recurse without limit in get\_value() and linearize\_page\_tree() (CVSS 6.3, python-pillow Pillow · pillow)
- [CVE-2026-76788](https://cve.now/CVE-2026-76788.md): Stack out-of-bounds write in the OSDP Control Panel reply parser (CVSS 8.8, zephyrproject zephyr)
- [CVE-2026-76787](https://cve.now/CVE-2026-76787.md): NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-112390](https://cve.now/CVE-2026-112390.md): Pillow: Infinite loop in MIC n\_frames when the embedded TIFF (CVSS 8.2, python-pillow Pillow · pillow)
- [CVE-2026-112300](https://cve.now/CVE-2026-112300.md): DiffSK configobj \_\_init\_\_.py \_sectionmarker redos (CVSS 6.9, DiffSK configobj)
- [CVE-2026-112299](https://cve.now/CVE-2026-112299.md): smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery (CVSS 5.3, smrealms smr)
- [CVE-2026-111766](https://cve.now/CVE-2026-111766.md): markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled (CVSS 3.7, markdown-it)
- [CVE-2026-112297](https://cve.now/CVE-2026-112297.md): ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery (CVSS 5.3, ptbsare anx-calibre-manager)
- [CVE-2026-71169](https://cve.now/CVE-2026-71169.md): Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. (CVSS 7.0, Dell Application Store)
- [CVE-2026-82166](https://cve.now/CVE-2026-82166.md): Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. (CVSS 8.8, Dell Application Store)
- [CVE-2026-71170](https://cve.now/CVE-2026-71170.md): Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. (CVSS 7.8, Dell Application Store)
- [CVE-2026-112254](https://cve.now/CVE-2026-112254.md): agit8or1 clientst0r Property URL Importer property\_url\_importer.py \_fetch\_html server-side request forgery (CVSS 5.3, agit8or1 clientst0r)
- [CVE-2026-112260](https://cve.now/CVE-2026-112260.md): Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-112782](https://cve.now/CVE-2026-112782.md): Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service (CVSS 8.7, getgrav grav)
- [CVE-2026-112781](https://cve.now/CVE-2026-112781.md): Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-\*@ Directives (CVSS 8.7, getgrav grav)
- [CVE-2026-112780](https://cve.now/CVE-2026-112780.md): Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ (CVSS 9.3, getgrav grav)
- [CVE-2026-112779](https://cve.now/CVE-2026-112779.md): Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass (CVSS 9.3, getgrav grav-plugin-api)
- [CVE-2026-112778](https://cve.now/CVE-2026-112778.md): Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations (CVSS 6.4, traefik)
- [CVE-2026-112777](https://cve.now/CVE-2026-112777.md): Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE (CVSS 8.7, craftcms cms)
- [CVE-2026-112776](https://cve.now/CVE-2026-112776.md): Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations (CVSS 9.3, craftcms cms)
- [CVE-2026-112775](https://cve.now/CVE-2026-112775.md): Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password (CVSS 8.7, craftcms cms)
- [CVE-2026-112774](https://cve.now/CVE-2026-112774.md): Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout (CVSS 8.7, craftcms cms)
- [CVE-2026-112773](https://cve.now/CVE-2026-112773.md): Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection (CVSS 8.7, craftcms cms)
- [CVE-2026-112772](https://cve.now/CVE-2026-112772.md): Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection (CVSS 8.7, craftcms cms)
- [CVE-2026-112771](https://cve.now/CVE-2026-112771.md): Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters (CVSS 7.1, craftcms cms)
- [CVE-2026-112770](https://cve.now/CVE-2026-112770.md): Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable (CVSS 8.7, craftcms cms)
- [CVE-2026-112769](https://cve.now/CVE-2026-112769.md): Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass (CVSS 2.3, parse-community parse-server)
- [CVE-2026-112768](https://cve.now/CVE-2026-112768.md): Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update (CVSS 6.9, parse-community parse-server)
- [CVE-2026-112252](https://cve.now/CVE-2026-112252.md): Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp\_cmdshell sql injection (CVSS 6.9, Wuxi Wubang Security Software Wubang Five-in-One Safety Pro…)
- [CVE-2026-112259](https://cve.now/CVE-2026-112259.md): Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-112251](https://cve.now/CVE-2026-112251.md): antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect (CVSS 5.3, antoinersx clawhost)
- [CVE-2026-109437](https://cve.now/CVE-2026-109437.md): Cognition \< 0.13.0 Unauthenticated RCE via Local Shell Backend (CVSS 9.2, CognicellAI Cognition)
- [CVE-2026-112249](https://cve.now/CVE-2026-112249.md): grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting (CVSS 4.8, grandnode2)
- [CVE-2026-109434](https://cve.now/CVE-2026-109434.md): Sleipnir Browser \< 3.9.0 Fullscreen Address Bar Spoofing (CVSS 5.1, Fenrir Sleipnir Mobile for Android)
- [CVE-2026-110688](https://cve.now/CVE-2026-110688.md): Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr\_parse (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110687](https://cve.now/CVE-2026-110687.md): Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16\_cmp (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110686](https://cve.now/CVE-2026-110686.md): Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode\_hv (CVSS 6.5, Cpanel-JSON-XS)
- [CVE-2026-110685](https://cve.now/CVE-2026-110685.md): Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode\_tag (CVSS 9.1, Cpanel-JSON-XS)
- [CVE-2026-110684](https://cve.now/CVE-2026-110684.md): Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode\_stringify (CVSS 8.1, Cpanel-JSON-XS)
- [CVE-2026-110682](https://cve.now/CVE-2026-110682.md): Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr\_parse (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110681](https://cve.now/CVE-2026-110681.md): Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread (CVSS 8.1, Cpanel-JSON-XS)
- [CVE-2026-110680](https://cve.now/CVE-2026-110680.md): Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in… (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110678](https://cve.now/CVE-2026-110678.md): Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max\_size in incr\_parse (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110677](https://cve.now/CVE-2026-110677.md): Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys\_as\_arrayref in decode\_hv (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110676](https://cve.now/CVE-2026-110676.md): Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow\_bignum (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110675](https://cve.now/CVE-2026-110675.md): Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow\_barekey in decode\_hv (CVSS 8.1, Cpanel-JSON-XS)
- [CVE-2026-110674](https://cve.now/CVE-2026-110674.md): Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys\_as\_arrayref in decode\_hv (CVSS 6.5, Cpanel-JSON-XS)
- [CVE-2026-110673](https://cve.now/CVE-2026-110673.md): Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow\_tags in decode\_tag (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-110672](https://cve.now/CVE-2026-110672.md): Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode\_hv (CVSS 7.5, Cpanel-JSON-XS)
- [CVE-2026-112248](https://cve.now/CVE-2026-112248.md): grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal (CVSS 5.1, grandnode2)
- [CVE-2026-11319](https://cve.now/CVE-2026-11319.md): TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity (CVSS 6.9, TickTick Limited TickTick for Android)
- [CVE-2026-55644](https://cve.now/CVE-2026-55644.md): Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin (CVSS 5.1, element-hq element-x-ios)
- [CVE-2026-105810](https://cve.now/CVE-2026-105810.md): Authenticated Local Stack Overflow in TP-Link Tapo C320WS (CVSS 8.5, TP-Link Systems Tapo C320WS)
- [CVE-2023-38375](https://cve.now/CVE-2023-38375.md): IBM Cloud Pak System Cross-Site Scripting (CVSS 6.1, IBM Cloud Pak System)
- [CVE-2026-3161](https://cve.now/CVE-2026-3161.md): IBM Cloud Pak System Risky Cryptographic Algorithm (CVSS 5.9, IBM Cloud Pak System)
- [CVE-2026-3295](https://cve.now/CVE-2026-3295.md): IBM Cloud Pak System Cross-Site Scripting (CVSS 7.4, IBM Cloud Pak System)
- [CVE-2026-4418](https://cve.now/CVE-2026-4418.md): IBM Cloud Pak System HTML Injection (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2026-111759](https://cve.now/CVE-2026-111759.md): markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes (CVSS 7.5, markdown-it)
- [CVE-2026-111757](https://cve.now/CVE-2026-111757.md): Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths (CVSS 5.3, honojs hono · hono)
- [CVE-2026-111755](https://cve.now/CVE-2026-111755.md): follow-redirects sensitiveHeaders regex escaping can expose credential headers (CVSS 8.2, follow-redirects)
- [CVE-2026-112377](https://cve.now/CVE-2026-112377.md): CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack (CVSS 9.1, CCC-Attestation attested-tls-poc)
- [CVE-2026-1501](https://cve.now/CVE-2026-1501.md): IBM Concert Software Improper Certificate Validation (CVSS 3.7, IBM Concert)
- [CVE-2026-1510](https://cve.now/CVE-2026-1510.md): IBM Concert Software Improper Clearing of Heap Memory (CVSS 4.7, IBM Concert)
- [CVE-2026-3303](https://cve.now/CVE-2026-3303.md): IBM Concert Software Permissive Cross-domain Security Policy (CVSS 3.7, IBM Concert)
- [CVE-2026-3628](https://cve.now/CVE-2026-3628.md): IBM Concert Software Information Disclosure (CVSS 5.3, IBM Concert)
- [CVE-2026-4405](https://cve.now/CVE-2026-4405.md): IBM Concert Software Use of Web Browser Cache Containing Sensitive Information (CVSS 4.0, IBM Concert)
- [CVE-2026-4413](https://cve.now/CVE-2026-4413.md): IBM Concert Software Cross-Site Scripting (CVSS 6.1, IBM Concert)
- [CVE-2026-6719](https://cve.now/CVE-2026-6719.md): IBM Concert Software Use of Insufficiently Random Values (CVSS 7.5, IBM Concert)
- [CVE-2026-112247](https://cve.now/CVE-2026-112247.md): Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting (CVSS 5.3, Wuxi Wubang Security Software Five-in-One Safety Production…)
- [CVE-2026-6930](https://cve.now/CVE-2026-6930.md): IBM Concert Software Risky Cryptographic Algorithm (CVSS 3.7, IBM Concert)
- [CVE-2026-15661](https://cve.now/CVE-2026-15661.md): IBM Concert Software Improper Output Neutralization for Logs (CVSS 5.3, IBM Concert)
- [CVE-2026-111750](https://cve.now/CVE-2026-111750.md): AIOHTTP: Pure-Python parser request smuggling (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2026-111749](https://cve.now/CVE-2026-111749.md): AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies (CVSS 2.3, aio-libs aiohttp · aiohttp)
- [CVE-2026-111748](https://cve.now/CVE-2026-111748.md): AIOHTTP: Absolute-form request targets can spoof Request.scheme (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2026-112195](https://cve.now/CVE-2026-112195.md): FusionPBX Dialplan Editor dialplan.php os command injection (CVSS 5.1, FusionPBX)
- [CVE-2026-111066](https://cve.now/CVE-2026-111066.md): AIOHTTP: File descriptor exhaustion in multipart requests (CVSS 8.2, aio-libs aiohttp · aiohttp)
- [CVE-2024-4412](https://cve.now/CVE-2024-4412.md): Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations (CVSS 2.7, WSO2 Enterprise Integrator · WSO2 API Manager +8)
- [CVE-2026-111065](https://cve.now/CVE-2026-111065.md): AIOHTTP: Connector pool exhaustion via Max-Age overflow (CVSS 6.9, aio-libs aiohttp · aiohttp)
- [CVE-2025-13173](https://cve.now/CVE-2025-13173.md): Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination (CVSS 6.5, WSO2 API Control Plane · WSO2 Universal Gateway +7)
- [CVE-2026-111064](https://cve.now/CVE-2026-111064.md): aiohttp server lacks an initial request/header timeout (CVSS 8.2, aio-libs aiohttp · aiohttp)
- [CVE-2025-13591](https://cve.now/CVE-2025-13591.md): Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery (CVSS 5.3, WSO2 Identity Server · WSO2 Carbon Abstract OTP Authenti… +1)
- [CVE-2026-112193](https://cve.now/CVE-2026-112193.md): Webkul Aureus ERP UserForm.php weak password (CVSS 6.3, Webkul Aureus ERP)
- [CVE-2026-111063](https://cve.now/CVE-2026-111063.md): AIOHTTP: Secure attribute not enforced for shared cookie (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2026-14511](https://cve.now/CVE-2026-14511.md): IBM MQ Denial of Service (CVSS 6.5, IBM MQ)
- [CVE-2026-10572](https://cve.now/CVE-2026-10572.md): IBM MQ Buffer Overflow (CVSS 8.8, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-10574](https://cve.now/CVE-2026-10574.md): IBM MQ Buffer Overflow (CVSS 8.8, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-10743](https://cve.now/CVE-2026-10743.md): IBM MQ Race Condition (CVSS 8.8, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-11828](https://cve.now/CVE-2026-11828.md): IBM MQ Buffer Overflow (CVSS 5.9, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-11829](https://cve.now/CVE-2026-11829.md): IBM MQ Buffer Overflow (CVSS 6.5, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-11831](https://cve.now/CVE-2026-11831.md): IBM MQ Heap-based Buffer Overflow (CVSS 5.4, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12148](https://cve.now/CVE-2026-12148.md): IBM MQ Deserialization of Untrusted Data (CVSS 7.5, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12155](https://cve.now/CVE-2026-12155.md): IBM MQ Deserialization of Untrusted Data (CVSS 6.5, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12343](https://cve.now/CVE-2026-12343.md): IBM MQ Denial of Service (CVSS 6.5, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12350](https://cve.now/CVE-2026-12350.md): IBM MQ Deserialization of Untrusted Data (CVSS 6.5, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2025-10149](https://cve.now/CVE-2025-10149.md): Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover (CVSS 8.2, WSO2 Identity Server as Key Manager · WSO2 Open Banking… +3)
- [CVE-2026-12660](https://cve.now/CVE-2026-12660.md): IBM MQ Path Traversal (CVSS 2.7, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12665](https://cve.now/CVE-2026-12665.md): IBM MQ Buffer Overflow (CVSS 8.1, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12669](https://cve.now/CVE-2026-12669.md): IBM MQ Out-of-bounds Read (CVSS 3.1, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12727](https://cve.now/CVE-2026-12727.md): IBM MQ Buffer Overflow (CVSS 4.3, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2026-12670](https://cve.now/CVE-2026-12670.md): IBM MQ Denial of Service (CVSS 5.3, IBM MQ Operator · IBM MQ Advanced container images)
- [CVE-2025-7203](https://cve.now/CVE-2025-7203.md): Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials (CVSS 4.9, WSO2 Universal Gateway · WSO2 Traffic Manager +6)
- [CVE-2026-107188](https://cve.now/CVE-2026-107188.md): Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution (CVSS 9.6, Eptura Archibus)
- [CVE-2026-111862](https://cve.now/CVE-2026-111862.md): Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code (CVSS 9.8, RankMath Rank Math SEO PRO)
- [CVE-2026-107187](https://cve.now/CVE-2026-107187.md): Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables (CVSS 8.5, Eptura Archibus)
- [CVE-2026-107186](https://cve.now/CVE-2026-107186.md): Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse (CVSS 8.6, Eptura Archibus)
- [CVE-2026-111061](https://cve.now/CVE-2026-111061.md): russh agent server converts constraint records into unbounded never-rolled-back tasks (CVSS 4.3, Eugeny russh · russh)
- [CVE-2026-112190](https://cve.now/CVE-2026-112190.md): Webkul Aureus ERP composer.json insertion of sensitive information into debugging code (CVSS 6.9, Webkul Aureus ERP)
- [CVE-2025-7043](https://cve.now/CVE-2025-7043.md): Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption (CVSS 5.4, WSO2 API Manager · WSO2 Universal Gateway +2)
- [CVE-2025-6623](https://cve.now/CVE-2025-6623.md): Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection (CVSS 4.3, WSO2 API Manager · WSO2 Universal Gateway +4)
- [CVE-2026-112159](https://cve.now/CVE-2026-112159.md): JumpServer Template Rendering os command injection (CVSS 5.1, JumpServer)
- [CVE-2026-103038](https://cve.now/CVE-2026-103038.md): PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host (CVSS 8.6, StreamSoft PingTools Network Utilities)
- [CVE-2026-111059](https://cve.now/CVE-2026-111059.md): Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML (CVSS 6.1, mljar mercury · mercury)
- [CVE-2026-111058](https://cve.now/CVE-2026-111058.md): Mercury: Unauthenticated Remote Code Execution via /api/kernels (CVSS 9.8, mljar mercury · mercury)
- [CVE-2026-111057](https://cve.now/CVE-2026-111057.md): Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass (CVSS 10.0, mljar mercury · mercury)
- [CVE-2026-111056](https://cve.now/CVE-2026-111056.md): FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint (CVSS 6.9, FOSSBilling)
- [CVE-2026-112158](https://cve.now/CVE-2026-112158.md): MikroTik RouterOS ipt\_SAME.ko same\_check integer overflow (CVSS 7.1, MikroTik RouterOS)
- [CVE-2026-111053](https://cve.now/CVE-2026-111053.md): FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template\_exists (CVSS 6.9, FOSSBilling)
- [CVE-2026-111046](https://cve.now/CVE-2026-111046.md): FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions (CVSS 2.3, FOSSBilling)
- [CVE-2026-112368](https://cve.now/CVE-2026-112368.md): Unbounded Recursion in phongo\_bson\_visit\_document/visit\_array: (CVSS 8.2, MongoDB PHP Driver)
- [CVE-2026-112157](https://cve.now/CVE-2026-112157.md): MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption (CVSS 2.3, MemTensor memmy-agent)
- [CVE-2026-111045](https://cve.now/CVE-2026-111045.md): CLI Bridge: High-severity sandbox escape via dangling symlink (CVSS 7.5, anshupriyan cli-bridge)
- [CVE-2026-12254](https://cve.now/CVE-2026-12254.md): Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue (CVSS 6.4, Netskope Client)
- [CVE-2026-107571](https://cve.now/CVE-2026-107571.md): Incorrect Default Permissions in hMailServer (CVSS 7.8, Progressive Robot hMailServer)
- [CVE-2026-107569](https://cve.now/CVE-2026-107569.md): Unchecked Input for Loop Condition in hMailServer (CVSS 7.5, Progressive Robot hMailServer)
- [CVE-2026-107566](https://cve.now/CVE-2026-107566.md): Missing Authorization in hMailServer (CVSS 6.5, Progressive Robot hMailServer)
- [CVE-2026-107568](https://cve.now/CVE-2026-107568.md): Missing Authorization in hMailServer (CVSS 6.5, Progressive Robot hMailServer)
- [CVE-2026-107567](https://cve.now/CVE-2026-107567.md): Use of Less Trusted Source in hMailServer (CVSS 7.5, Progressive Robot hMailServer)
- [CVE-2026-112153](https://cve.now/CVE-2026-112153.md): vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli\_error sql injection (CVSS 6.9, vraj404 Criminal-Management-System)
- [CVE-2026-112366](https://cve.now/CVE-2026-112366.md): Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns (CVSS 8.7, micromatch picomatch)
- [CVE-2026-112363](https://cve.now/CVE-2026-112363.md): Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from\_url URL Userinfo (CVSS 6.9, unclecode crawl4ai)
- [CVE-2026-112310](https://cve.now/CVE-2026-112310.md): docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef (CVSS 5.3, docling-project docling-core)
- [CVE-2026-112309](https://cve.now/CVE-2026-112309.md): @rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods (CVSS 8.7, airjp73 @rvf/set-get)
- [CVE-2026-112308](https://cve.now/CVE-2026-112308.md): crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool (CVSS 8.3, crewAIInc crewai-tools)
- [CVE-2026-112307](https://cve.now/CVE-2026-112307.md): sqlparse through 0.6.0 PHP Code Injection via output\_format='php' (CVSS 8.4, andialbrecht sqlparse)
- [CVE-2026-112306](https://cve.now/CVE-2026-112306.md): NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields (CVSS 8.6, nocobase)
- [CVE-2026-112305](https://cve.now/CVE-2026-112305.md): Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override (CVSS 8.7, semaphoreui Semaphore UI)
- [CVE-2026-112304](https://cve.now/CVE-2026-112304.md): docTR through 1.1.0 Unsafe Deserialization RCE via load\_pretrained\_params() (CVSS 7.7, Mindee docTR)
- [CVE-2026-112303](https://cve.now/CVE-2026-112303.md): GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs (CVSS 5.3, GDevelop)
- [CVE-2026-112152](https://cve.now/CVE-2026-112152.md): vraj404 Criminal-Management-System Search searchOff.php mysqli\_query sql injection (CVSS 6.9, vraj404 Criminal-Management-System)
- [CVE-2026-109433](https://cve.now/CVE-2026-109433.md): Camunda Broken Access Control via Cockpit (CVSS 6.0, Camunda)
- [CVE-2026-109432](https://cve.now/CVE-2026-109432.md): Camunda Expression Injection via orQueries RCE (CVSS 9.3, Camunda)
- [CVE-2026-109431](https://cve.now/CVE-2026-109431.md): Camunda Missing Authorization in Task Sub-Resources (CVSS 8.6, Camunda)
- [CVE-2026-112151](https://cve.now/CVE-2026-112151.md): vraj404 Criminal Management System Submission Form home.php sql injection (CVSS 6.9, vraj404 Criminal Management System)
- [CVE-2026-86375](https://cve.now/CVE-2026-86375.md): Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. (CVSS 6.2, Dell Application Installer,)
- [CVE-2026-112329](https://cve.now/CVE-2026-112329.md): Sensei LMS 4.26.4 Broken Access Control via save\_new\_message (CVSS 5.3, Automattic Sensei LMS)
- [CVE-2026-112150](https://cve.now/CVE-2026-112150.md): vraj404 Criminal-Management-System search.php sql injection (CVSS 6.9, vraj404 Criminal-Management-System)
- [CVE-2026-112328](https://cve.now/CVE-2026-112328.md): Sensei LMS 4.26.4 Broken Access Control via add\_new\_module\_term AJAX (CVSS 5.3, Automattic Sensei LMS)
- [CVE-2026-112149](https://cve.now/CVE-2026-112149.md): vraj404 Criminal-Management-System home.php move\_uploaded\_file unrestricted upload (CVSS 6.9, vraj404 Criminal-Management-System)
- [CVE-2026-112147](https://cve.now/CVE-2026-112147.md): ai-genius-automations octoally index.ts information disclosure (CVSS 6.9, ai-genius-automations octoally)
- [CVE-2026-112146](https://cve.now/CVE-2026-112146.md): D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials (CVSS 5.3, D-Link E15 · D-Link M32 +2)
- [CVE-2026-112296](https://cve.now/CVE-2026-112296.md): FlyCms through commit edfdf724 Default Super Administrator Credentials (CVSS 9.3, sunkaifei FlyCms)
- [CVE-2026-112295](https://cve.now/CVE-2026-112295.md): FlyCms through commit edfdf724 Mass Assignment via /ucenter/account\_update (CVSS 5.3, sunkaifei FlyCms)
- [CVE-2026-112294](https://cve.now/CVE-2026-112294.md): FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint (CVSS 5.3, sunkaifei FlyCms)
- [CVE-2026-112293](https://cve.now/CVE-2026-112293.md): BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API (CVSS 5.3, BoxyHQ saas-starter-kit)
- [CVE-2026-112292](https://cve.now/CVE-2026-112292.md): CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules (CVSS 9.3, operacle checkcle)
- [CVE-2026-112291](https://cve.now/CVE-2026-112291.md): Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API (CVSS 6.9, Flarum Extension Manager)
- [CVE-2026-112290](https://cve.now/CVE-2026-112290.md): MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item (CVSS 2.3, MI6 Intelligence Community UI Kit canary web components)
- [CVE-2026-112289](https://cve.now/CVE-2026-112289.md): Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin (CVSS 5.1, KoalixSwitzerland koalixcrm)
- [CVE-2026-112288](https://cve.now/CVE-2026-112288.md): Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding (CVSS 2.1, krayin laravel-crm)
- [CVE-2026-112287](https://cve.now/CVE-2026-112287.md): Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module (CVSS 7.1, krayin laravel-crm)
- [CVE-2026-112286](https://cve.now/CVE-2026-112286.md): Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints (CVSS 7.1, krayin laravel-crm)
- [CVE-2026-112285](https://cve.now/CVE-2026-112285.md): Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders (CVSS 5.3, Thelia)
- [CVE-2026-112284](https://cve.now/CVE-2026-112284.md): libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR (CVSS 4.8, xqq libaribcaption)
- [CVE-2026-112283](https://cve.now/CVE-2026-112283.md): libbluray through 1.5.1 Uncontrolled Memory Allocation via \_parse\_extent\_start\_points (CVSS 6.8, VideoLAN libbluray)
- [CVE-2026-112282](https://cve.now/CVE-2026-112282.md): VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi\_access\_point (CVSS 6.8, VideoLAN libbluray)
- [CVE-2026-112281](https://cve.now/CVE-2026-112281.md): libaribb24 through 1.0.3 Stack Buffer Overflow via decoder\_handle\_csi (CVSS 6.9, nkoriyama aribb24)
- [CVE-2026-112280](https://cve.now/CVE-2026-112280.md): libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse\_data\_unit\_statement\_body (CVSS 6.9, nkoriyama aribb24)
- [CVE-2026-112279](https://cve.now/CVE-2026-112279.md): rdesktop through 1.9.0 Heap Out-of-Bounds Read via process\_bmpcache2 (CVSS 7.1, rdesktop)
- [CVE-2026-112278](https://cve.now/CVE-2026-112278.md): rdesktop through 1.9.0 Heap Out-of-Bounds Read via process\_raw\_bmpcache (CVSS 7.1, rdesktop)
- [CVE-2026-112277](https://cve.now/CVE-2026-112277.md): rdesktop through 1.9.0 Heap Out-of-Bounds Read via process\_plane (CVSS 7.1, rdesktop)
- [CVE-2026-112276](https://cve.now/CVE-2026-112276.md): Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap (CVSS 6.9, Netpbm)
- [CVE-2026-112275](https://cve.now/CVE-2026-112275.md): Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr\_load\_image (CVSS 6.9, Netpbm)
- [CVE-2026-112274](https://cve.now/CVE-2026-112274.md): libtins through 4.6 Out-of-Bounds Read via DNS::soa\_record::init (CVSS 6.3, libtins)
- [CVE-2026-112273](https://cve.now/CVE-2026-112273.md): libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose\_name (CVSS 6.9, libtins)
- [CVE-2026-112272](https://cve.now/CVE-2026-112272.md): libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser (CVSS 6.8, emersion libdisplay-info)
- [CVE-2026-112271](https://cve.now/CVE-2026-112271.md): libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser (CVSS 6.8, emersion libdisplay-info)
- [CVE-2026-112270](https://cve.now/CVE-2026-112270.md): SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING\_RSP chunk\_idx (CVSS 7.1, sgl-project sglang)
- [CVE-2026-112269](https://cve.now/CVE-2026-112269.md): SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations (CVSS 7.1, sgl-project sglang)
- [CVE-2026-112268](https://cve.now/CVE-2026-112268.md): sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes (CVSS 5.3, sgl-project sglang-router)
- [CVE-2026-112267](https://cve.now/CVE-2026-112267.md): SGLang through 0.5.22 SSRF via bootstrap\_host and bootstrap\_port on Decode Worker (CVSS 6.9, sgl-project sglang)
- [CVE-2026-112266](https://cve.now/CVE-2026-112266.md): SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching (CVSS 8.2, sgl-project sglang)
- [CVE-2026-112265](https://cve.now/CVE-2026-112265.md): LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification (CVSS 8.3, langbot-app LangBot)
- [CVE-2026-112264](https://cve.now/CVE-2026-112264.md): BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys (CVSS 8.5, BentoML)
- [CVE-2026-112263](https://cve.now/CVE-2026-112263.md): Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting (CVSS 8.5, alexpasmantier television)
- [CVE-2026-112262](https://cve.now/CVE-2026-112262.md): RisingWave before 3.1.0 Missing Authorization via posix\_fs and fs Connectors (CVSS 7.1, risingwavelabs risingwave)
- [CVE-2026-111939](https://cve.now/CVE-2026-111939.md): Frappe Helpdesk before 1.26.0 Authorization Bypass via raised\_by in Ticket Creation (CVSS 5.1, frappe helpdesk)
- [CVE-2026-111938](https://cve.now/CVE-2026-111938.md): Frappe CRM before 1.74.0 Missing Authorization via add\_note\_to\_call\_log (CVSS 5.3, frappe crm)
- [CVE-2026-111937](https://cve.now/CVE-2026-111937.md): Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records (CVSS 5.3, frappe crm)
- [CVE-2026-111936](https://cve.now/CVE-2026-111936.md): Sigma File Manager through 2.2.0 SSRF via Extension Download Commands (CVSS 5.3, aleksey-hoffman Sigma File Manager)
- [CVE-2026-111935](https://cve.now/CVE-2026-111935.md): NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis (CVSS 2.1, codexu NoteGen)
- [CVE-2026-111925](https://cve.now/CVE-2026-111925.md): Mopidy before 4.0.5 Path Traversal via File Backend library.lookup (CVSS 6.9, Mopidy)
- [CVE-2026-111915](https://cve.now/CVE-2026-111915.md): Yank Note before 3.93.1 Path Traversal via /api/help Endpoint (CVSS 8.2, purocean Yank Note)
- [CVE-2026-111899](https://cve.now/CVE-2026-111899.md): KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch (CVSS 5.3, TomBursch kitchenowl)
- [CVE-2026-111883](https://cve.now/CVE-2026-111883.md): Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset (CVSS 5.3, locustio locust)
- [CVE-2026-112145](https://cve.now/CVE-2026-112145.md): speaches-ai speaches Pyannote Diarization Model Loading pyannote\_diarization.py PyannoteDiarizationModelManager.\_load\_fn externally-controlled input to select classes or code (CVSS 6.9, speaches-ai speaches)
- [CVE-2026-112144](https://cve.now/CVE-2026-112144.md): satya-vinay Events-Management-System project.sql file access (CVSS 6.9, satya-vinay Events-Management-System)
- [CVE-2026-111828](https://cve.now/CVE-2026-111828.md): WordPress Classified Listing plugin \<= 6.1.5 - Direct static code injection vulnerability (CVSS 4.3, Mamunur Rashid Classified Listing)
- [CVE-2026-112222](https://cve.now/CVE-2026-112222.md): WordPress Surfer plugin \<= 1.8.0.744 - Broken Access Control vulnerability (CVSS 5.4, Surfer)
- [CVE-2026-111829](https://cve.now/CVE-2026-111829.md): WordPress WP Mailster plugin \<= 1.9.1.0 - Local File Inclusion vulnerability (CVSS 6.5, WP Mailster)
- [CVE-2026-110902](https://cve.now/CVE-2026-110902.md): WordPress Event Tickets plugin \<= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Liquid Web / StellarWP Event Tickets)
- [CVE-2026-110008](https://cve.now/CVE-2026-110008.md): @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback (CVSS 4.2, @fastify/oauth2)
- [CVE-2026-112143](https://cve.now/CVE-2026-112143.md): satya-vinay Events-Management-System missing authentication (CVSS 6.9, satya-vinay Events-Management-System)
- [CVE-2026-8168](https://cve.now/CVE-2026-8168.md): Denial-of-service vulnerability in the SVG parser and renderer impacts Qt (CVSS 7.1, qt)
- [CVE-2026-112142](https://cve.now/CVE-2026-112142.md): satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection (CVSS 6.9, satya-vinay Events-Management-System)
- [CVE-2026-111845](https://cve.now/CVE-2026-111845.md): WordPress YITH WooCommerce Product Bundles plugin \<= 2.29.0 - Broken Access Control vulnerability (CVSS 5.3, YITH WooCommerce Product Bundles)
- [CVE-2026-112141](https://cve.now/CVE-2026-112141.md): satya-vinay Events-Management-System Registration-Edit doedit.php mysqli\_query sql injection (CVSS 6.9, satya-vinay Events-Management-System)
- [CVE-2026-111831](https://cve.now/CVE-2026-111831.md): WordPress FluentForm plugin \<= 6.2.15 - Broken Access Control vulnerability (CVSS 5.3, WP ManageNinja FluentForm)
- [CVE-2026-110363](https://cve.now/CVE-2026-110363.md): WordPress LearnPress plugin \<= 4.4.10 - Broken Access Control vulnerability (CVSS 5.4, ThimPress LearnPress)
- [CVE-2026-111836](https://cve.now/CVE-2026-111836.md): WordPress FluentCommunity plugin \<= 2.11.0 - Broken Access Control vulnerability (CVSS 4.3, WP ManageNinja FluentCommunity)
- [CVE-2026-111414](https://cve.now/CVE-2026-111414.md): WordPress JetElements For Elementor plugin \<= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor)
- [CVE-2026-111410](https://cve.now/CVE-2026-111410.md): WordPress e2pdf plugin \<= 1.32.57 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, E2Pdf.com e2pdf)
- [CVE-2026-112214](https://cve.now/CVE-2026-112214.md): Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-103314](https://cve.now/CVE-2026-103314.md): Stackrox: stackrox: saml response replay allows multiple central authentication tokens (CVSS 7.4, Red Hat Advanced Cluster Security for Kubernetes)
- [CVE-2026-111839](https://cve.now/CVE-2026-111839.md): WordPress Broadcast Live Video plugin \<= 7.3.7 - Broken Access Control vulnerability (CVSS 5.3, VideoWhisper.com Broadcast Live Video)
- [CVE-2026-112199](https://cve.now/CVE-2026-112199.md): WordPress YITH WooCommerce Wishlist plugin \<= 4.18.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, YITH WooCommerce Wishlist)
- [CVE-2026-112140](https://cve.now/CVE-2026-112140.md): llSourcell Doctor-Dignity chat\_module.py \_get\_lib\_module code injection (CVSS 5.3, llSourcell Doctor-Dignity)
- [CVE-2026-112139](https://cve.now/CVE-2026-112139.md): subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection (CVSS 6.9, subhajitkhan online-clinic-management-system)
- [CVE-2026-112210](https://cve.now/CVE-2026-112210.md): Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service (CVSS 6.0, Red Hat Enterprise Linux)
- [CVE-2026-112138](https://cve.now/CVE-2026-112138.md): diem-project diem dmCodeEditor actions.class.php join path traversal (CVSS 5.1, diem-project diem)
- [CVE-2026-112108](https://cve.now/CVE-2026-112108.md): ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow (CVSS 5.3, ztxz16 fastllm)
- [CVE-2026-88900](https://cve.now/CVE-2026-88900.md): Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution (CVSS 8.8, Apache Software Foundation Apache Camel)
- [CVE-2026-112107](https://cve.now/CVE-2026-112107.md): ztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflow (CVSS 5.3, ztxz16 fastllm)
- [CVE-2026-91858](https://cve.now/CVE-2026-91858.md): Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present (CVSS 6.5, Apache Software Foundation Apache Camel)
- [CVE-2026-112106](https://cve.now/CVE-2026-112106.md): TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation (CVSS 6.3, TufayelLUS TikTok-Video-Downloader-PHP)
- [CVE-2026-88901](https://cve.now/CVE-2026-88901.md): Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default (CVSS 8.2, Apache Software Foundation Apache Camel)
- [CVE-2026-85317](https://cve.now/CVE-2026-85317.md): Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache (CVSS 4.8, Apache Software Foundation Apache Camel)
- [CVE-2026-85316](https://cve.now/CVE-2026-85316.md): Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching (CVSS 4.8, Apache Software Foundation Apache Camel)
- [CVE-2026-85315](https://cve.now/CVE-2026-85315.md): Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation Apache Camel)
- [CVE-2026-85314](https://cve.now/CVE-2026-85314.md): Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) (CVSS 6.5, Apache Software Foundation Apache Camel)
- [CVE-2026-85313](https://cve.now/CVE-2026-85313.md): Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set (CVSS 4.3, Apache Software Foundation Apache Camel)
- [CVE-2026-85312](https://cve.now/CVE-2026-85312.md): Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header (CVSS 4.8, Apache Software Foundation Apache Camel)
- [CVE-2026-85300](https://cve.now/CVE-2026-85300.md): Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions (CVSS 5.5, Apache Software Foundation Apache Camel)
- [CVE-2026-85301](https://cve.now/CVE-2026-85301.md): Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim (CVSS 4.8, Apache Software Foundation Apache Camel)
- [CVE-2026-85296](https://cve.now/CVE-2026-85296.md): Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State (CVSS 6.5, Apache Software Foundation Apache Camel)
- [CVE-2026-85260](https://cve.now/CVE-2026-85260.md): Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default (CVSS 5.5, Apache Software Foundation Apache Camel)
- [CVE-2026-85257](https://cve.now/CVE-2026-85257.md): Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation Apache Camel)
- [CVE-2026-85254](https://cve.now/CVE-2026-85254.md): Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing (CVSS 6.5, Apache Software Foundation Apache Camel)
- [CVE-2026-71253](https://cve.now/CVE-2026-71253.md): Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON (CVSS 9.8, Apache Software Foundation Apache Johnzon)
- [CVE-2026-85251](https://cve.now/CVE-2026-85251.md): Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets (CVSS 7.5, Apache Software Foundation Apache Camel)
- [CVE-2026-85250](https://cve.now/CVE-2026-85250.md): Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option (CVSS 7.5, Apache Software Foundation Apache Camel)
- [CVE-2026-85249](https://cve.now/CVE-2026-85249.md): Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata (CVSS 6.5, Apache Software Foundation Apache Camel)
- [CVE-2026-85248](https://cve.now/CVE-2026-85248.md): Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance (CVSS 5.9, Apache Software Foundation Apache Camel)
- [CVE-2026-85247](https://cve.now/CVE-2026-85247.md): Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore (CVSS 5.9, Apache Software Foundation Apache Camel)
- [CVE-2026-85246](https://cve.now/CVE-2026-85246.md): Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation Apache Camel)
- [CVE-2026-85245](https://cve.now/CVE-2026-85245.md): Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target (CVSS 5.9, Apache Software Foundation Apache Camel)
- [CVE-2026-85243](https://cve.now/CVE-2026-85243.md): Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure (CVSS 5.9, Apache Software Foundation Apache Camel)
- [CVE-2026-84181](https://cve.now/CVE-2026-84181.md): Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse (CVSS 5.9, Apache Software Foundation Apache Camel)
- [CVE-2026-84180](https://cve.now/CVE-2026-84180.md): Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions (CVSS 5.3, Apache Software Foundation Apache Camel)
- [CVE-2026-84178](https://cve.now/CVE-2026-84178.md): Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow (CVSS 6.1, Apache Software Foundation Apache Camel)
- [CVE-2026-112105](https://cve.now/CVE-2026-112105.md): GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation (CVSS 6.3, GlitterWare Passy)
- [CVE-2026-84176](https://cve.now/CVE-2026-84176.md): Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection (CVSS 6.5, Apache Software Foundation Apache Camel)
- [CVE-2026-83531](https://cve.now/CVE-2026-83531.md): Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages (CVSS 8.8, Apache Software Foundation Apache Camel)
- [CVE-2026-80344](https://cve.now/CVE-2026-80344.md): Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address (CVSS 8.2, Apache Software Foundation Apache Camel)
- [CVE-2026-80343](https://cve.now/CVE-2026-80343.md): Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching (CVSS 8.2, Apache Software Foundation Apache Camel)
- [CVE-2026-80312](https://cve.now/CVE-2026-80312.md): Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors (CVSS 8.2, Apache Software Foundation Apache Camel)
- [CVE-2026-79986](https://cve.now/CVE-2026-79986.md): Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside (CVSS 7.4, Apache Software Foundation Apache Camel)
- [CVE-2026-79985](https://cve.now/CVE-2026-79985.md): Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside (CVSS 7.4, Apache Software Foundation Apache Camel)
- [CVE-2026-79984](https://cve.now/CVE-2026-79984.md): Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside (CVSS 7.4, Apache Software Foundation Apache Camel)
- [CVE-2026-112104](https://cve.now/CVE-2026-112104.md): eremef bandcamp-player Remote Control Server database.ts missing authentication (CVSS 6.9, eremef bandcamp-player)
- [CVE-2026-79983](https://cve.now/CVE-2026-79983.md): Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside (CVSS 7.4, Apache Software Foundation Apache Camel)
- [CVE-2026-78165](https://cve.now/CVE-2026-78165.md): Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads (CVSS 8.8, Apache Software Foundation Apache Camel)
- [CVE-2026-78164](https://cve.now/CVE-2026-78164.md): Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers (CVSS 8.2, Apache Software Foundation Apache Camel)
- [CVE-2026-78163](https://cve.now/CVE-2026-78163.md): Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure (CVSS 5.9, Apache Software Foundation Apache Camel)
- [CVE-2026-78162](https://cve.now/CVE-2026-78162.md): Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) (CVSS 10.0, Apache Software Foundation Apache Camel)
- [CVE-2026-112103](https://cve.now/CVE-2026-112103.md): f3-factory fatfree-core HTTP Client web.php \_curl certificate validation (CVSS 6.3, f3-factory fatfree-core)
- [CVE-2026-112102](https://cve.now/CVE-2026-112102.md): AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection (CVSS 5.3, AXA Group NLP.js)
- [CVE-2026-90910](https://cve.now/CVE-2026-90910.md): Apache Answer: Reaction API authorization bypass for restricted content (CVSS 9.8, Apache Software Foundation Apache Answer)
- [CVE-2026-86589](https://cve.now/CVE-2026-86589.md): Apache Answer: User Center integration does not revoke first-login sessions after central account suspension (CVSS 5.4, Apache Software Foundation Apache Answer)
- [CVE-2026-79633](https://cve.now/CVE-2026-79633.md): Apache Answer: Missing Authorization Allows Mutations of Non-Public Content (no CVSS, Apache Software Foundation Apache Answer)
- [CVE-2026-79624](https://cve.now/CVE-2026-79624.md): Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation (no CVSS, Apache Software Foundation Apache Answer)
- [CVE-2026-79620](https://cve.now/CVE-2026-79620.md): Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata (no CVSS, Apache Software Foundation Apache Answer)
- [CVE-2026-79613](https://cve.now/CVE-2026-79613.md): Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles (no CVSS, Apache Software Foundation Apache Answer)
- [CVE-2026-76994](https://cve.now/CVE-2026-76994.md): Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles (no CVSS, Apache Software Foundation Apache Answer)
- [CVE-2026-71563](https://cve.now/CVE-2026-71563.md): Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions (CVSS 4.3, Apache Software Foundation Apache Answer)
- [CVE-2026-68482](https://cve.now/CVE-2026-68482.md): Apache Answer: Improper Authorization in Question Invite User Lookup (CVSS 5.3, Apache Software Foundation Apache Answer)
- [CVE-2026-67249](https://cve.now/CVE-2026-67249.md): Apache Answer: Email Code Purpose Confusion May Allow Account Takeover (CVSS 5.4, Apache Software Foundation Apache Answer)
- [CVE-2026-64945](https://cve.now/CVE-2026-64945.md): Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions (low (no CVSS), Apache Software Foundation Apache Answer)
- [CVE-2026-112101](https://cve.now/CVE-2026-112101.md): BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation (CVSS 5.3, BlackBeltTechnology pi-agent-dashboard)
- [CVE-2026-112192](https://cve.now/CVE-2026-112192.md): MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings (CVSS 5.3, MISP)
- [CVE-2026-64944](https://cve.now/CVE-2026-64944.md): Apache Answer: Stored XSS via unsanitized HTML in imported question content (low (no CVSS), Apache Software Foundation Apache Answer)
- [CVE-2026-64943](https://cve.now/CVE-2026-64943.md): Apache Answer: API keys logged in plaintext during authentication (CVSS 8.1, Apache Software Foundation Apache Answer)
- [CVE-2026-112188](https://cve.now/CVE-2026-112188.md): MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution (CVSS 7.1, MISP)
- [CVE-2026-108837](https://cve.now/CVE-2026-108837.md): Apache Kylin: Potential computed-column resource exhaustion (low (no CVSS), Apache Software Foundation Apache Kylin)
- [CVE-2026-108833](https://cve.now/CVE-2026-108833.md): Apache Kylin: default startup profile miss security settings (low (no CVSS), Apache Software Foundation Apache Kylin)
- [CVE-2026-108823](https://cve.now/CVE-2026-108823.md): Apache Kylin: Potential unauthenticated job metadata replacement (no CVSS, Apache Software Foundation Apache Kylin)
- [CVE-2026-108780](https://cve.now/CVE-2026-108780.md): Apache Kylin: Potential JDBC source configuration validation issue (CVSS 6.5, Apache Software Foundation Apache Kylin)
- [CVE-2026-108776](https://cve.now/CVE-2026-108776.md): Apache Kylin: tables/names SparkSQL injection (CVSS 5.3, Apache Software Foundation Apache Kylin)
- [CVE-2026-108771](https://cve.now/CVE-2026-108771.md): Apache Kylin: unauthenticated broadcast API and polymorphic deserialization (CVSS 9.8, Apache Software Foundation Apache Kylin)
- [CVE-2026-108766](https://cve.now/CVE-2026-108766.md): Apache Kylin: missing JDBC-config authorization (CVSS 6.5, Apache Software Foundation Apache Kylin)
- [CVE-2026-112184](https://cve.now/CVE-2026-112184.md): MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels (CVSS 4.8, MISP)
- [CVE-2026-108764](https://cve.now/CVE-2026-108764.md): Apache Kylin: job-driver UI proxy SSRF (CVSS 6.5, Apache Software Foundation Apache Kylin)
- [CVE-2026-108762](https://cve.now/CVE-2026-108762.md): Apache Kylin: delete metadata backup path-confinement bypass (CVSS 7.3, Apache Software Foundation Apache Kylin)
- [CVE-2026-112183](https://cve.now/CVE-2026-112183.md): MISP CSS Injection via Remote Tag Colour in Event Preview (CVSS 4.8, MISP)
- [CVE-2026-112100](https://cve.now/CVE-2026-112100.md): DeepPavlov multitask\_preprocessor.py MultiTaskPipelinePreprocessor.\_\_init\_\_ code injection (CVSS 5.1, DeepPavlov)
- [CVE-2026-110887](https://cve.now/CVE-2026-110887.md): WordPress HivePress plugin \<= 1.7.32 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, HivePress)
- [CVE-2026-111398](https://cve.now/CVE-2026-111398.md): WordPress MapSVG plugin \<= 8.16.1 - Arbitrary File Deletion vulnerability (CVSS 7.7, PT Norther Lights Production MapSVG)
- [CVE-2026-110898](https://cve.now/CVE-2026-110898.md): WordPress Essential Addons for Elementor plugin \<= 6.8.5 - Privilege Escalation vulnerability (CVSS 6.4, WPDeveloper Essential Addons for Elementor)
- [CVE-2026-111407](https://cve.now/CVE-2026-111407.md): WordPress Tutor LMS plugin \<= 4.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeum Tutor LMS)
- [CVE-2026-111408](https://cve.now/CVE-2026-111408.md): WordPress Quiz And Survey Master plugin \<= 11.2.7 - PHP Object Injection vulnerability (CVSS 8.8, ExpressTech Quiz And Survey Master)
- [CVE-2026-110379](https://cve.now/CVE-2026-110379.md): WordPress Quiz Maker plugin \<= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ays Pro Quiz Maker)
- [CVE-2026-111406](https://cve.now/CVE-2026-111406.md): WordPress MapSVG plugin \<= 8.16.1 - Arbitrary File Upload vulnerability (CVSS 9.9, PT Norther Lights Production MapSVG)
- [CVE-2026-112098](https://cve.now/CVE-2026-112098.md): DeepPavlov Config Reference Resolver params.py resolve code injection (CVSS 5.3, DeepPavlov)
- [CVE-2026-112180](https://cve.now/CVE-2026-112180.md): MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records (CVSS 5.1, MISP)
- [CVE-2026-112179](https://cve.now/CVE-2026-112179.md): MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances (CVSS 5.3, MISP)
- [CVE-2026-112178](https://cve.now/CVE-2026-112178.md): MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control (CVSS 7.1, MISP)
- [CVE-2026-112097](https://cve.now/CVE-2026-112097.md): SourceCodester Inventory System Sales Management transactions\_handler.php save\_sale cross site scripting (CVSS 5.1, SourceCodester Inventory System)
- [CVE-2026-13695](https://cve.now/CVE-2026-13695.md): SQL Injection in the Integratec Application (CVSS 8.8, Integratec)
- [CVE-2026-104679](https://cve.now/CVE-2026-104679.md): VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. (CVSS 7.1, Yamaha VOCALOID6 Editor)
- [CVE-2026-112096](https://cve.now/CVE-2026-112096.md): SourceCodester Inventory System Purchase Records transactions\_handler.php save\_purchase cross site scripting (CVSS 5.1, SourceCodester Inventory System)
- [CVE-2026-112161](https://cve.now/CVE-2026-112161.md): Lack of integrity checks in Mobatek’s MobaXterm (CVSS 8.5, Mobatek MobaXterm)
- [CVE-2026-112095](https://cve.now/CVE-2026-112095.md): SourceCodester Inventory System Product Management products\_handler.php save cross site scripting (CVSS 5.1, SourceCodester Inventory System)
- [CVE-2026-111438](https://cve.now/CVE-2026-111438.md): check\_hba\_replication 认证与访问控制绕过 (CVSS 6.5, openGauss-server)
- [CVE-2026-112094](https://cve.now/CVE-2026-112094.md): michaelrsweet mxml mxml-file.c mxml\_load\_data use after free (CVSS 5.1, michaelrsweet mxml)
- [CVE-2026-111439](https://cve.now/CVE-2026-111439.md): pg\_read\_binary\_file\_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块 (CVSS 4.3, openGauss-server)
- [CVE-2026-112093](https://cve.now/CVE-2026-112093.md): subhajitkhan online-clinic-management-system feedback.php cross site scripting (CVSS 5.3, subhajitkhan online-clinic-management-system)
- [CVE-2026-112092](https://cve.now/CVE-2026-112092.md): subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting (CVSS 5.3, subhajitkhan online-clinic-management-system)
- [CVE-2026-112091](https://cve.now/CVE-2026-112091.md): Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure (CVSS 6.9, Dav-ee dairy-management-system)
- [CVE-2026-112090](https://cve.now/CVE-2026-112090.md): Dav-ee dairy-management-system pay.php mysqli\_real\_escape\_string sql injection (CVSS 5.3, Dav-ee dairy-management-system)
- [CVE-2026-94294](https://cve.now/CVE-2026-94294.md): App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php (CVSS 5.3, App Builder)
- [CVE-2026-94272](https://cve.now/CVE-2026-94272.md): Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions (CVSS 5.3, Snap Finance)
- [CVE-2026-94231](https://cve.now/CVE-2026-94231.md): TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification (CVSS 5.3, TrueBooker)
- [CVE-2026-94230](https://cve.now/CVE-2026-94230.md): TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions (CVSS 5.3, TrueBooker)
- [CVE-2026-94229](https://cve.now/CVE-2026-94229.md): TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter (CVSS 5.3, TrueBooker)
- [CVE-2026-94228](https://cve.now/CVE-2026-94228.md): TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin\_setting\_setup\_data (CVSS 5.3, TrueBooker)
- [CVE-2026-91831](https://cve.now/CVE-2026-91831.md): Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting (CVSS 3.8, Subscribe to Comments)
- [CVE-2026-86791](https://cve.now/CVE-2026-86791.md): iPOSpays Payment Gateway for WooCommerce \< 1.4.7 - Unauthenticated Payment Confirmation Forgery (CVSS 5.3, iPOSpays Payment Gateway for WooCommerce)
- [CVE-2026-74922](https://cve.now/CVE-2026-74922.md): Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass (CVSS 5.3, Document Gallery)
- [CVE-2026-74921](https://cve.now/CVE-2026-74921.md): Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes (CVSS 6.8, Document Gallery)
- [CVE-2026-110034](https://cve.now/CVE-2026-110034.md): Salon Booking System \< 10.31.11 - Unauthenticated Negative Booking Total via Discount Code (CVSS 3.7, Salon Booking System)
- [CVE-2026-106010](https://cve.now/CVE-2026-106010.md): BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery (CVSS 5.3, BDM Digital Payment Gateway)
- [CVE-2026-103311](https://cve.now/CVE-2026-103311.md): Coinbase Commerce Payment Gateway for WooCommerce \<= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret (CVSS 5.3, Coinbase Commerce Payment Gateway for WooCommerce)
- [CVE-2026-112089](https://cve.now/CVE-2026-112089.md): Dav-ee dairy-management-system delete.php mysqli\_query sql injection (CVSS 5.1, Dav-ee dairy-management-system)
- [CVE-2026-16460](https://cve.now/CVE-2026-16460.md): Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization (CVSS 7.4, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-112088](https://cve.now/CVE-2026-112088.md): Dav-ee dairy-management-system add.php mysqli\_query sql injection (CVSS 5.3, Dav-ee dairy-management-system)
- [CVE-2026-76740](https://cve.now/CVE-2026-76740.md): HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability (CVSS 7.2, Hewlett Packard Enterprise HPE Compute Scale-up Server 3… +2)
- [CVE-2026-112087](https://cve.now/CVE-2026-112087.md): itsourcecode Online Cake Ordering System confirm.php sql injection (CVSS 5.3, itsourcecode Online Cake Ordering System)
- [CVE-2026-112086](https://cve.now/CVE-2026-112086.md): ESPnet Inference Model inference\_model.py build\_model deserialization (CVSS 5.3, ESPnet)
- [CVE-2026-94273](https://cve.now/CVE-2026-94273.md): Snap Finance \<= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap\_finance\_complete\_payment (CVSS 5.3, Snap Finance)
- [CVE-2026-106014](https://cve.now/CVE-2026-106014.md): Gateway for Vantiv on WC \<= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery (CVSS 5.3, Gateway for Vantiv on WC)
- [CVE-2026-89286](https://cve.now/CVE-2026-89286.md): FormFlow for GoHighLevel \<= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File (CVSS 5.3, FormFlow for GoHighLevel)
- [CVE-2026-91047](https://cve.now/CVE-2026-91047.md): ElementsReady Addons for Elementor \<= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter (CVSS 5.3, ElementsReady Addons for Elementor)
- [CVE-2026-91046](https://cve.now/CVE-2026-91046.md): ElementsReady Addons for Elementor \<= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization (CVSS 4.3, ElementsReady Addons for Elementor)
- [CVE-2026-106933](https://cve.now/CVE-2026-106933.md): Blaze Demo Importer \< 1.0.17 - Author+ Stored XSS via SVG Upload (CVSS 6.8, Blaze Demo Importer)
- [CVE-2026-106028](https://cve.now/CVE-2026-106028.md): ActiveTrail for WooCommerce \<= 1.2.6 - Unauthenticated Arbitrary Coupon Creation (CVSS 5.3, ActiveTrail for WooCommerce)
- [CVE-2026-76739](https://cve.now/CVE-2026-76739.md): HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modification (CVSS 4.3, Hewlett Packard Enterprise HPE Compute Scale-up Server 3… +1)
- [CVE-2026-112083](https://cve.now/CVE-2026-112083.md): sgl-project SGLang Weight Exporter weight\_exporter.py WeightExporter.send\_weights\_to\_remote\_instance denial of service (CVSS 6.9, sgl-project SGLang)
- [CVE-2026-112082](https://cve.now/CVE-2026-112082.md): sgl-project SGLang Expert-Distribution Recording Endpoint expert\_distribution.py Scheduler.expert\_distribution\_handle denial of service (CVSS 8.7, sgl-project SGLang)
- [CVE-2026-112081](https://cve.now/CVE-2026-112081.md): hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization (CVSS 5.3, hankcs HanLP)
- [CVE-2026-108120](https://cve.now/CVE-2026-108120.md): path traversal inKoozali - SME Server (CVSS 7.7, koozali SME Server)
- [CVE-2026-108121](https://cve.now/CVE-2026-108121.md): Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service (CVSS 6.9, Koozali SME Server)
- [CVE-2026-112080](https://cve.now/CVE-2026-112080.md): LlamaChinese Llama-Chinese Adapter Config chat\_gradio\_no\_merge.py get\_class\_from\_dynamic\_module code injection (CVSS 5.3, LlamaChinese Llama-Chinese)
- [CVE-2026-112079](https://cve.now/CVE-2026-112079.md): hankcs HanLP torch\_util.py load\_word2vec\_as\_vocab\_tensor deserialization (CVSS 5.3, hankcs HanLP)
- [CVE-2026-112078](https://cve.now/CVE-2026-112078.md): RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change\_info\_ code injection (CVSS 5.3, RVC-Project Retrieval-based-Voice-Conversion-WebUI)
- [CVE-2026-112077](https://cve.now/CVE-2026-112077.md): radareorg radare2 HTTP Sandbox Policy rtr\_http.inc.c r\_core\_cmd\_str\_pipe protection mechanism (CVSS 6.3, radareorg radare2)
- [CVE-2026-112076](https://cve.now/CVE-2026-112076.md): alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.\_\_write\_feed\_metadata\_sync server-side request forgery (CVSS 6.3, alexta69 MeTube)
- [CVE-2026-111440](https://cve.now/CVE-2026-111440.md): JDBC LogFactory 任意类加载/构造导致潜在 RCE (CVSS 7.0, openGauss-server openGauss-connector-jdbc)
- [CVE-2026-112075](https://cve.now/CVE-2026-112075.md): unslothai unsloth sentence\_transformer.py externally-controlled input to select classes or code (CVSS 5.3, unslothai unsloth)
- [CVE-2026-112074](https://cve.now/CVE-2026-112074.md): Tencent ncnn Conversion API mat\_pixel.cpp yuv420sp2rgb integer overflow (CVSS 5.3, Tencent ncnn)
- [CVE-2026-112073](https://cve.now/CVE-2026-112073.md): Tencent ncnn MatMul matmul.cpp matmul\_transb out-of-bounds (CVSS 5.3, Tencent ncnn)
- [CVE-2026-112045](https://cve.now/CVE-2026-112045.md): donetick History Deletion model.go CanDeleteHistory improper authorization (CVSS 5.3, donetick)
- [CVE-2026-112044](https://cve.now/CVE-2026-112044.md): dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication (CVSS 6.9, dotnet eShop)
- [CVE-2026-111441](https://cve.now/CVE-2026-111441.md): HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写 (CVSS 8.1, openGauss-server)
- [CVE-2026-112043](https://cve.now/CVE-2026-112043.md): calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization (CVSS 5.3, calcom cal.com · calcom cal.diy)
- [CVE-2026-103091](https://cve.now/CVE-2026-103091.md): Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM) (CVSS 9.3, Google SAM)
- [CVE-2026-102503](https://cve.now/CVE-2026-102503.md): Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM) (CVSS 9.3, Google SAM)
- [CVE-2026-112042](https://cve.now/CVE-2026-112042.md): diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting (CVSS 5.1, diem-project diem)
- [CVE-2026-112041](https://cve.now/CVE-2026-112041.md): diem-project diem dmString.php random weak prng (CVSS 6.3, diem-project diem)
- [CVE-2026-112040](https://cve.now/CVE-2026-112040.md): diem-project diem Sign-In BasedmUserActions.class.php redirect (CVSS 5.3, diem-project diem)
- [CVE-2026-112039](https://cve.now/CVE-2026-112039.md): diem-project diem Administrative Console actions.class.php append cross site scripting (CVSS 4.8, diem-project diem)
- [CVE-2026-112038](https://cve.now/CVE-2026-112038.md): diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting (CVSS 4.8, diem-project diem)
- [CVE-2026-112037](https://cve.now/CVE-2026-112037.md): diem-project diem Google Analytics Client gapi.class.php certificate validation (CVSS 6.3, diem-project diem)
- [CVE-2026-108984](https://cve.now/CVE-2026-108984.md): GV-ASManager Web Server Buffer Overflow Vulnerability (CVSS 7.5, GeoVision GV-ASManager)
- [CVE-2026-108983](https://cve.now/CVE-2026-108983.md): GV-ASManager Web Server Command Injection Vulnerability (CVSS 9.8, GeoVision GV-ASManager)
- [CVE-2026-112036](https://cve.now/CVE-2026-112036.md): Artifex MuPDF Signature Locking pdf-xref.c free\_char\_list double free (CVSS 5.3, Artifex MuPDF)
- [CVE-2026-112035](https://cve.now/CVE-2026-112035.md): aircheng-org iWebShop-5 simple.php send\_message\_mobile password recovery (CVSS 5.3, aircheng-org iWebShop-5)
- [CVE-2026-112034](https://cve.now/CVE-2026-112034.md): aircheng-org iWebShop-5 Login Redirect \_userInfo.php redirect (CVSS 5.3, aircheng-org iWebShop-5)
- [CVE-2026-112033](https://cve.now/CVE-2026-112033.md): aircheng-org iWebShop-5 Password Change system.php admin\_repwd\_act cross-site request forgery (CVSS 5.3, aircheng-org iWebShop-5)
- [CVE-2025-52290](https://cve.now/CVE-2025-52290.md): A NULL pointer dereference in the avpriv\_h264\_has\_num\_reorder\_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cau (CVSS 7.5)
- [CVE-2025-55654](https://cve.now/CVE-2025-55654.md): A use-after-free in the gf\_filter\_pid\_get\_packet function (filter\_core/filter\_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial (CVSS 5.5)
- [CVE-2025-55667](https://cve.now/CVE-2025-55667.md): A segmentation violation in the dump\_isom\_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attacke (CVSS 5.5)
- [CVE-2025-60480](https://cve.now/CVE-2025-60480.md): A heap buffer overflow in the gf\_odf\_ac4\_cfg\_alternative\_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c354 (CVSS 5.5)
- [CVE-2025-60482](https://cve.now/CVE-2025-60482.md): A heap use-after-free in the gf\_odf\_ac4\_cfg\_clean\_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-maste (CVSS 5.5)
- [CVE-2026-107081](https://cve.now/CVE-2026-107081.md): SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX\_lookup\_handler.p (CVSS 9.8)
- [CVE-2026-107082](https://cve.now/CVE-2026-107082.md): Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac\_hide and (CVSS 8.8)
- [CVE-2026-107083](https://cve.now/CVE-2026-107083.md): SENAYAN Library Management System (SLiMS) Bulian (slims9\_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl\_ (CVSS 9.8)
- [CVE-2026-107084](https://cve.now/CVE-2026-107084.md): Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan\_hi (CVSS 8.8)
- [CVE-2026-38671](https://cve.now/CVE-2026-38671.md): Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed ve (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.