# CVEs published 2026-10-23

500 CVEs were published on October 23, 2026: 39 critical, 171 high. Days are UTC.

- [CVE-2026-115931](https://cve.now/CVE-2026-115931.md): Arbitrary file read and backend crash through unrestricted provider method calls (CVSS 9.9, GitroomHQ postiz-app)
- [CVE-2026-115938](https://cve.now/CVE-2026-115938.md): Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE (CVSS 8.7, craftcms cms)
- [GHSA-H4FR-CMH5-QR62](https://cve.now/GHSA-H4FR-CMH5-QR62.md): Fallow: A \`.\*\` glob segment let an analyzed repository make Fallow test paths in the parent of the project root (low (no CVSS), fallow · @fallow-cli/fallow-node +3)
- [GHSA-F2HQ-32VH-53CC](https://cve.now/GHSA-F2HQ-32VH-53CC.md): postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words (high (no CVSS), postal-mime)
- [GHSA-8C8M-P3M8-CJG8](https://cve.now/GHSA-8C8M-P3M8-CJG8.md): Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient (medium (no CVSS), nodemailer)
- [GHSA-M943-M63M-W62W](https://cve.now/GHSA-M943-M63M-W62W.md): Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient (medium (no CVSS), nodemailer)
- [GHSA-85X2-Q946-CP5H](https://cve.now/GHSA-85X2-Q946-CP5H.md): Nodemailer: A "\>" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name (medium (no CVSS), nodemailer)
- [CVE-2026-115937](https://cve.now/CVE-2026-115937.md): Unauthenticated payment reuse allows unpaid orders to be marked as paid (CVSS 8.7, craftcms commerce-mollie)
- [CVE-2026-115801](https://cve.now/CVE-2026-115801.md): Kakao khaiii JSON Config File Linear.cpp open out-of-bounds (CVSS 4.8, Kakao khaiii)
- [GHSA-XMJ3-9GF7-H52W](https://cve.now/GHSA-XMJ3-9GF7-H52W.md): setuptools: Windows path escape via namespace\_packages.txt during legacy wheel installation Description (low (no CVSS), setuptools)
- [CVE-2026-115935](https://cve.now/CVE-2026-115935.md): Control panel only API response emulation replaces "securityKey" and reaches server RCE (CVSS 8.7, craftcms cms)
- [CVE-2026-115897](https://cve.now/CVE-2026-115897.md): Serialize JavaScript: Cross-site scripting (XSS) via unescaped \</script at the end of a serialized function body (CVSS 2.1, yahoo serialize-javascript · serialize-javascript)
- [CVE-2026-115895](https://cve.now/CVE-2026-115895.md): Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution (CVSS 8.8, capricorn86 happy-dom · happy-dom)
- [GHSA-7XGJ-8392-5Q4R](https://cve.now/GHSA-7XGJ-8392-5Q4R.md): FastMCP: Post-transform component authorization is skipped on direct calls (medium (no CVSS), fastmcp · fastmcp-slim)
- [GHSA-VQQP-X5QM-5QP4](https://cve.now/GHSA-VQQP-X5QM-5QP4.md): FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authori (medium (no CVSS), fastmcp · fastmcp-slim)
- [CVE-2026-115893](https://cve.now/CVE-2026-115893.md): Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm \`br\_table\` instruction (CVSS 9.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115892](https://cve.now/CVE-2026-115892.md): Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type (CVSS 5.7, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115889](https://cve.now/CVE-2026-115889.md): Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (CVSS 9.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115887](https://cve.now/CVE-2026-115887.md): graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service (CVSS 7.5, graphql-hive graphql-scalars · graphql-scalars)
- [CVE-2026-115886](https://cve.now/CVE-2026-115886.md): MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints (CVSS 6.5, mlflow)
- [CVE-2026-115885](https://cve.now/CVE-2026-115885.md): LangGraph CLI prints the registry push token in \`langgraph deploy --verbose\` output (CVSS 4.1, langchain-ai langgraph · langgraph-cli)
- [CVE-2026-115883](https://cve.now/CVE-2026-115883.md): LangGraph: Namespace labels containing \`.\` reach other namespaces in Postgres and SQLite stores (CVSS 6.0, langchain-ai langgraph · langchain-ai langgraph-checkpoi… +3)
- [CVE-2026-113951](https://cve.now/CVE-2026-113951.md): If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes (no CVSS, Apple Container)
- [CVE-2026-75525](https://cve.now/CVE-2026-75525.md): OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant (CVSS 5.3, open-reception appointment-booking-software)
- [CVE-2026-115800](https://cve.now/CVE-2026-115800.md): UbiquitousLearning mllm Convertor \_\_init\_\_.py load\_model path traversal (CVSS 4.8, UbiquitousLearning mllm)
- [CVE-2026-75524](https://cve.now/CVE-2026-75524.md): OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent (CVSS 5.4, open-reception appointment-booking-software)
- [CVE-2026-65825](https://cve.now/CVE-2026-65825.md): OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants (CVSS 7.5, open-reception appointment-booking-software)
- [CVE-2026-65824](https://cve.now/CVE-2026-65824.md): OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie (CVSS 7.4, open-reception appointment-booking-software)
- [CVE-2026-58202](https://cve.now/CVE-2026-58202.md): OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via \`POST /api/auth/resend-confirmation\` (CVSS 8.3, open-reception appointment-booking-software)
- [CVE-2026-115877](https://cve.now/CVE-2026-115877.md): Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value (CVSS 5.4, twisted)
- [CVE-2026-83813](https://cve.now/CVE-2026-83813.md): Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation (CVSS 3.1, twisted)
- [CVE-2026-115778](https://cve.now/CVE-2026-115778.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer (CVSS 7.5, twisted)
- [CVE-2026-115776](https://cve.now/CVE-2026-115776.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer (CVSS 7.5, twisted)
- [CVE-2026-115775](https://cve.now/CVE-2026-115775.md): Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree (CVSS 8.7, twisted)
- [CVE-2026-115774](https://cve.now/CVE-2026-115774.md): Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH (CVSS 4.9, twisted)
- [CVE-2026-113877](https://cve.now/CVE-2026-113877.md): HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions (no CVSS, HTTP-Headers-ActionPack)
- [CVE-2026-115797](https://cve.now/CVE-2026-115797.md): Tenda F6 Web Management cleartext transmission (CVSS 6.3, Tenda F6)
- [CVE-2026-79982](https://cve.now/CVE-2026-79982.md): Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size (CVSS 8.8, zephyrproject zephyr)
- [CVE-2026-79981](https://cve.now/CVE-2026-79981.md): DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-79980](https://cve.now/CVE-2026-79980.md): Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS (CVSS 5.6, zephyrproject zephyr)
- [CVE-2026-79979](https://cve.now/CVE-2026-79979.md): Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-79978](https://cve.now/CVE-2026-79978.md): Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path (CVSS 3.6, zephyrproject zephyr)
- [CVE-2026-79977](https://cve.now/CVE-2026-79977.md): WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr (CVSS 8.2, zephyrproject zephyr)
- [CVE-2026-19741](https://cve.now/CVE-2026-19741.md): OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) (CVSS 7.5, zephyrproject zephyr)
- [CVE-2026-115796](https://cve.now/CVE-2026-115796.md): Tenda F6 Web Management cross-site request forgery (CVSS 5.3, Tenda F6)
- [CVE-2026-115586](https://cve.now/CVE-2026-115586.md): virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) (CVSS 7.1, pypa virtualenv · virtualenv)
- [CVE-2026-115585](https://cve.now/CVE-2026-115585.md): pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-115580](https://cve.now/CVE-2026-115580.md): pypdf: Possible long runtimes for large xref table header limits (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-115572](https://cve.now/CVE-2026-115572.md): pypdf: Possible long runtimes for repeated references to the same missing object (CVSS 7.1, py-pdf pypdf · pypdf)
- [CVE-2026-115845](https://cve.now/CVE-2026-115845.md): Incomplete validation in the run\_script Python sandbox in AWS MCP Server (CVSS 6.4, AWS MCP Server)
- [CVE-2026-91093](https://cve.now/CVE-2026-91093.md): HP One Agent Software – Security Update (CVSS 8.5, HP One Agent Software)
- [CVE-2026-112342](https://cve.now/CVE-2026-112342.md): Tandoor Recipes \< 2.7.0 Cross-Space Permission Cache Poisoning (CVSS 7.1, Tandoor Recipes)
- [CVE-2026-115570](https://cve.now/CVE-2026-115570.md): Electron: Mitigation for compromised eMudhra intermediate certificates (CVSS 7.4, electron)
- [CVE-2026-115569](https://cve.now/CVE-2026-115569.md): Fallow: Jest and Vitest \`projects\` entries let an analyzed repository make Fallow read files outside the project root (CVSS 3.3, fallow-rs fallow · @fallow-cli fallow-node +6)
- [CVE-2026-115863](https://cve.now/CVE-2026-115863.md): ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. (CVSS 7.6, ConnMan)
- [CVE-2026-115813](https://cve.now/CVE-2026-115813.md): Server-side request forgery in the model download path in Amazon Web Services Multi Model Server (CVSS 5.8, AWS multi-model-server)
- [CVE-2026-115812](https://cve.now/CVE-2026-115812.md): Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server (CVSS 9.8, AWS multi-model-server)
- [CVE-2026-115567](https://cve.now/CVE-2026-115567.md): Tokio: Race condition in \`tokio::time::Interval\` (CVSS 5.8, tokio-rs tokio · tokio)
- [CVE-2026-110975](https://cve.now/CVE-2026-110975.md): Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure (CVSS 7.4, kruize-autotune)
- [CVE-2026-106069](https://cve.now/CVE-2026-106069.md): A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the c (CVSS 7.4, nodejs node)
- [CVE-2026-105481](https://cve.now/CVE-2026-105481.md): A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the (CVSS 6.5, nodejs node)
- [CVE-2026-105482](https://cve.now/CVE-2026-105482.md): A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve\*() functions and dns.rev (CVSS 7.4, nodejs node)
- [CVE-2026-106074](https://cve.now/CVE-2026-106074.md): A flaw in Node.js \`crypto\` causes the internal entropy caches used by \`crypto.randomUUID()\`, \`crypto.randomUUIDv7()\`, and \`crypto.randomInt( (CVSS 4.8, nodejs node)
- [CVE-2026-106071](https://cve.now/CVE-2026-106071.md): A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard \`--allow-fs-read\` or \`--all (CVSS 3.6, nodejs node)
- [CVE-2026-106072](https://cve.now/CVE-2026-106072.md): A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects (CVSS 6.7, nodejs node)
- [CVE-2026-87901](https://cve.now/CVE-2026-87901.md): Improper sanitization in the registration module allows reflected Cross-Site Scripting. (CVSS 8.3, phpBB)
- [CVE-2026-105483](https://cve.now/CVE-2026-105483.md): A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 a (CVSS 7.4, nodejs node)
- [CVE-2026-106070](https://cve.now/CVE-2026-106070.md): A flaw in the Node.js \`zlib.ZipFile\` API can cause it to return bytes that do not belong to the requested entry after the local and central (CVSS 3.7, nodejs node)
- [CVE-2026-106073](https://cve.now/CVE-2026-106073.md): A flaw in Node.js Permission Model filesystem enforcement leaves \`fs.realpathSync()\` without the required read permission checks. (CVSS 3.3, nodejs node)
- [CVE-2026-115810](https://cve.now/CVE-2026-115810.md): Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL (CVSS 6.3, TandoorRecipes recipes)
- [CVE-2026-57845](https://cve.now/CVE-2026-57845.md): Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder (CVSS 8.7, huggingface datasets)
- [CVE-2026-54668](https://cve.now/CVE-2026-54668.md): Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config) (CVSS 8.7, kitodo-production)
- [CVE-2026-58497](https://cve.now/CVE-2026-58497.md): Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests (CVSS 8.6, olo-dot-io Uni-CLI · @zenalexa/unicli)
- [CVE-2026-49442](https://cve.now/CVE-2026-49442.md): Cacti: User Enumeration via Error Messages (CVSS 5.3, cacti)
- [CVE-2026-39902](https://cve.now/CVE-2026-39902.md): Cacti: Authenticated RCE on Data Input (CVSS 7.2, cacti)
- [CVE-2026-46531](https://cve.now/CVE-2026-46531.md): Cacti: Authenticated Stored 2nd-Order SQL Injection in automation\_tree\_rule\_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) (CVSS 5.5, cacti)
- [CVE-2026-102786](https://cve.now/CVE-2026-102786.md): Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 (CVSS 8.6, phoca.cz Phoca Gallery extension for Joomla)
- [CVE-2026-55222](https://cve.now/CVE-2026-55222.md): Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap (CVSS 5.1, ilbers isar)
- [CVE-2026-53942](https://cve.now/CVE-2026-53942.md): Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC\_TOKEN (CVSS 9.9, conda infrastructure)
- [CVE-2026-55486](https://cve.now/CVE-2026-55486.md): Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS (CVSS 9.3, intranda goobi-viewer-core)
- [CVE-2026-55465](https://cve.now/CVE-2026-55465.md): Goobi viewer: Solr injection via unvalidated region parameter in spatial search (CVSS 5.3, intranda goobi-viewer-core)
- [CVE-2026-55463](https://cve.now/CVE-2026-55463.md): Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation (CVSS 6.5, intranda goobi-viewer-core)
- [CVE-2026-112333](https://cve.now/CVE-2026-112333.md): GFI Archiver \< 15.14 Stored XSS via MailInsights.aspx (CVSS 5.1, GFI Software GFI Archiver)
- [CVE-2026-55459](https://cve.now/CVE-2026-55459.md): Goobi viewer: OpenID JWT audience not enforced by the verifier (CVSS 7.4, intranda goobi-viewer-core)
- [CVE-2026-55457](https://cve.now/CVE-2026-55457.md): Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass (CVSS 7.4, intranda goobi-viewer-core)
- [CVE-2026-55444](https://cve.now/CVE-2026-55444.md): Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters (CVSS 5.3, intranda goobi-viewer-core)
- [CVE-2026-46652](https://cve.now/CVE-2026-46652.md): Path traversal via HTTP \`Content-Disposition\` header in ExternalFilesDownloader enables remote code execution in Goobi viewer (CVSS 9.8, intranda goobi-viewer-core)
- [CVE-2026-46651](https://cve.now/CVE-2026-46651.md): Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer (CVSS 9.8, intranda goobi-viewer-core)
- [CVE-2026-46347](https://cve.now/CVE-2026-46347.md): Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset (CVSS 6.8, intranda goobi-viewer-core)
- [CVE-2026-46346](https://cve.now/CVE-2026-46346.md): Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset (CVSS 6.5, intranda goobi-viewer-core)
- [CVE-2026-55442](https://cve.now/CVE-2026-55442.md): Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection (CVSS 5.3, intranda goobi-viewer-core)
- [CVE-2026-115478](https://cve.now/CVE-2026-115478.md): obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes (CVSS 7.1, The-40-Thieves obsidian-tc · obsidian-tc)
- [CVE-2026-115477](https://cve.now/CVE-2026-115477.md): obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP (CVSS 7.1, The-40-Thieves obsidian-tc · obsidian-tc)
- [CVE-2026-115457](https://cve.now/CVE-2026-115457.md): baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments (CVSS 7.1, baserproject basercms)
- [CVE-2026-115786](https://cve.now/CVE-2026-115786.md): Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion (CVSS 6.5, Zimbra Collaboration Suite)
- [CVE-2026-115785](https://cve.now/CVE-2026-115785.md): Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address (CVSS 4.3, Zimbra Collaboration Suite)
- [CVE-2026-114624](https://cve.now/CVE-2026-114624.md): baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity (CVSS 7.2, baserproject basercms)
- [CVE-2026-114623](https://cve.now/CVE-2026-114623.md): baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure (CVSS 6.5, baserproject basercms)
- [CVE-2026-114622](https://cve.now/CVE-2026-114622.md): baserCMS: Encoded path traversal bypass in the theme file API (CVSS 7.2, baserproject basercms)
- [CVE-2026-57207](https://cve.now/CVE-2026-57207.md): NetBox MCP Server: HTTP transport exposes all NetBox data without authentication (CVSS 5.9, netboxlabs netbox-mcp-server)
- [CVE-2026-114621](https://cve.now/CVE-2026-114621.md): baserCMS: SQL injection in the admin panel and admin API (CVSS 8.8, baserproject basercms)
- [CVE-2026-114357](https://cve.now/CVE-2026-114357.md): DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) (CVSS 7.0, DJI CrystalSky ZS600C)
- [CVE-2026-57208](https://cve.now/CVE-2026-57208.md): Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind (CVSS 6.2, entireio cli · github.com/entireio/cli)
- [CVE-2026-114356](https://cve.now/CVE-2026-114356.md): DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization (CVSS 7.0, DJI CrystalSky ZS600C)
- [CVE-2026-115480](https://cve.now/CVE-2026-115480.md): baserCMS: Public Web API mail-form submission bypasses image CAPTCHA (CVSS 5.3, baserproject basercms)
- [CVE-2026-115479](https://cve.now/CVE-2026-115479.md): baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients (CVSS 5.3, baserproject basercms)
- [CVE-2026-114355](https://cve.now/CVE-2026-114355.md): DJI CrystalSky ZS600C hardware\_monitor evaluates attacker-controlled log data as root (CVSS 8.6, DJI CrystalSky ZS600C)
- [CVE-2026-93640](https://cve.now/CVE-2026-93640.md): Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration (CVSS 7.8, Zimbra Collaboration Suite)
- [CVE-2026-115481](https://cve.now/CVE-2026-115481.md): baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload (CVSS 8.5, baserproject basercms)
- [CVE-2026-114354](https://cve.now/CVE-2026-114354.md): DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root (CVSS 8.6, DJI CrystalSky ZS600C)
- [CVE-2026-50057](https://cve.now/CVE-2026-50057.md): Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions (CVSS 7.8, Zimbra Collaboration Suite)
- [CVE-2026-114353](https://cve.now/CVE-2026-114353.md): DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution (CVSS 7.0, DJI CrystalSky ZS600C)
- [CVE-2026-50056](https://cve.now/CVE-2026-50056.md): Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection (CVSS 7.8, Zimbra Collaboration Suite)
- [CVE-2026-93639](https://cve.now/CVE-2026-93639.md): Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation (CVSS 8.7, Zimbra Collaboration Suite)
- [CVE-2026-93638](https://cve.now/CVE-2026-93638.md): Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter (CVSS 6.1, Zimbra Collaboration Suite)
- [CVE-2026-55826](https://cve.now/CVE-2026-55826.md): Customer Order Data Exposed via Unauthenticated gtm\_server\_side\_order\_id Cookie Manipulation in GTM Server Side WordPress Plugin (CVSS 8.7, stape-io gtm-server-side-wordpress-plugin)
- [CVE-2026-93636](https://cve.now/CVE-2026-93636.md): Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name (CVSS 4.3, Zimbra Collaboration Suite)
- [CVE-2026-93634](https://cve.now/CVE-2026-93634.md): Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records (CVSS 4.3, Zimbra Collaboration Suite)
- [CVE-2026-93633](https://cve.now/CVE-2026-93633.md): Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters (CVSS 5.4, Zimbra Collaboration Suite)
- [CVE-2026-93631](https://cve.now/CVE-2026-93631.md): Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking (CVSS 7.1, Zimbra Collaboration Suite)
- [CVE-2026-93630](https://cve.now/CVE-2026-93630.md): Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization (CVSS 4.3, Zimbra Collaboration Suite)
- [CVE-2026-55606](https://cve.now/CVE-2026-55606.md): odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() (CVSS 6.5, openwrt odhcpd)
- [CVE-2026-53918](https://cve.now/CVE-2026-53918.md): odhcpd DHCPv6 IA dangling first pointer use-after-free (CVSS 8.8, openwrt odhcpd)
- [CVE-2026-53920](https://cve.now/CVE-2026-53920.md): odhcpd DHCPv6 Short IA\_NA/IA\_PD Body Stack Disclosure (CVSS 8.7, openwrt odhcpd)
- [CVE-2026-115754](https://cve.now/CVE-2026-115754.md): serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped \</script in function body (CVSS 2.3, yahoo serialize-javascript · serialize-javascript)
- [CVE-2026-53921](https://cve.now/CVE-2026-53921.md): odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) (CVSS 9.8, openwrt odhcpd)
- [CVE-2026-93629](https://cve.now/CVE-2026-93629.md): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity (CVSS 5.3, Zimbra Collaboration Suite)
- [CVE-2026-93628](https://cve.now/CVE-2026-93628.md): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response (CVSS 5.3, Zimbra Collaboration Suite)
- [CVE-2026-93627](https://cve.now/CVE-2026-93627.md): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer (CVSS 5.3, Zimbra Collaboration Suite)
- [CVE-2026-50053](https://cve.now/CVE-2026-50053.md): Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters (CVSS 8.7, Zimbra Collaboration Suite)
- [CVE-2026-10632](https://cve.now/CVE-2026-10632.md): Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter (CVSS 8.7, Zimbra Collaboration Suite)
- [CVE-2026-115752](https://cve.now/CVE-2026-115752.md): Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon (CVSS 2.3, signalk-server)
- [CVE-2026-115751](https://cve.now/CVE-2026-115751.md): mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname (CVSS 6.3, agentfront mcp-from-openapi)
- [CVE-2026-115750](https://cve.now/CVE-2026-115750.md): mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects (CVSS 6.3, agentfront mcp-from-openapi)
- [CVE-2026-115749](https://cve.now/CVE-2026-115749.md): hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import (CVSS 4.8, hydra-ecosystem hydra-ray-launcher)
- [CVE-2026-112848](https://cve.now/CVE-2026-112848.md): WordPress Hostme v2 theme \<= 7.0 - PHP Object Injection vulnerability (CVSS 9.8, AivahThemes Hostme)
- [CVE-2026-112849](https://cve.now/CVE-2026-112849.md): WordPress Hostme v2 theme \<= 7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AivahThemes Hostme)
- [CVE-2026-112850](https://cve.now/CVE-2026-112850.md): WordPress Your Dress theme \<= 1.4.1 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes Your Dress)
- [CVE-2026-112854](https://cve.now/CVE-2026-112854.md): WordPress Holistic Center theme \<= 1.2.6 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Holistic Center)
- [CVE-2026-112847](https://cve.now/CVE-2026-112847.md): WordPress ZenSoul theme \<= 1.13 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX ZenSoul)
- [CVE-2026-112846](https://cve.now/CVE-2026-112846.md): WordPress Save Life theme \<= 1.2.14 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Save Life)
- [CVE-2026-112851](https://cve.now/CVE-2026-112851.md): WordPress HotLock theme \<= 1.3.9 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group HotLock)
- [CVE-2026-112852](https://cve.now/CVE-2026-112852.md): WordPress Helion theme \<= 1.1.12 - PHP Object Injection vulnerability (CVSS 8.1, ThemeREX Group Helion)
- [CVE-2026-112853](https://cve.now/CVE-2026-112853.md): WordPress Hallelujah theme \<= 1.1.1 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Hallelujah)
- [CVE-2026-112856](https://cve.now/CVE-2026-112856.md): WordPress Vagabonds theme \<= 1.3.10 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Vagabonds)
- [CVE-2026-112857](https://cve.now/CVE-2026-112857.md): WordPress Reprizo theme \<= 1.0.8 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Reprizo)
- [CVE-2026-112858](https://cve.now/CVE-2026-112858.md): WordPress Rhodos theme \<= 1.3.3 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Rhodos)
- [CVE-2026-112859](https://cve.now/CVE-2026-112859.md): WordPress Little Birdies theme \<= 1.3.16 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Little Birdies)
- [CVE-2026-112855](https://cve.now/CVE-2026-112855.md): WordPress Redy theme \<= 1.3.5 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Redy)
- [CVE-2026-112863](https://cve.now/CVE-2026-112863.md): WordPress KALLYAS theme \<= 4.25.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hogash KALLYAS)
- [CVE-2026-115730](https://cve.now/CVE-2026-115730.md): i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl (CVSS 2.3, i18next-http-backend)
- [CVE-2026-115729](https://cve.now/CVE-2026-115729.md): @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass (CVSS 8.9, pdfme common)
- [CVE-2026-115728](https://cve.now/CVE-2026-115728.md): @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing (CVSS 8.7, hapijs @hapi/content · @hapi/content)
- [CVE-2026-99087](https://cve.now/CVE-2026-99087.md): dm-integrity: fix NULL pointer dereference when the 'R' flag is used (no CVSS, Linux)
- [CVE-2026-99086](https://cve.now/CVE-2026-99086.md): dm-integrity: validate the superblock on resume (no CVSS, Linux)
- [CVE-2026-99085](https://cve.now/CVE-2026-99085.md): sched\_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler (no CVSS, Linux)
- [CVE-2026-99084](https://cve.now/CVE-2026-99084.md): readdir: take no inode lock on an immutable directory (no CVSS, Linux)
- [CVE-2026-99083](https://cve.now/CVE-2026-99083.md): ksmbd: fix heap out-of-bounds write in krb5\_authenticate() (CVSS 8.8, Linux)
- [CVE-2026-99082](https://cve.now/CVE-2026-99082.md): KVM: x86: Use active memslots for the per-vCPU MMIO cache (CVSS 8.8, Linux)
- [CVE-2026-55888](https://cve.now/CVE-2026-55888.md): XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal (CVSS 8.8, flatpak xdg-desktop-portal)
- [CVE-2026-55889](https://cve.now/CVE-2026-55889.md): XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key (CVSS 8.3, flatpak xdg-desktop-portal)
- [CVE-2026-57210](https://cve.now/CVE-2026-57210.md): Heimdall: IP Spoofing via Unvalidated Forwarding Headers (CVSS 7.0, dadrus heimdall · https://github.com/dadrus/heimdall +1)
- [CVE-2026-57209](https://cve.now/CVE-2026-57209.md): Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode (CVSS 7.0, dadrus heimdall · github.com/dadrus/heimdall)
- [CVE-2026-55190](https://cve.now/CVE-2026-55190.md): Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse\_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import (CVSS 6.5, eventschedule)
- [CVE-2026-99081](https://cve.now/CVE-2026-99081.md): bnxt\_en: fix DMA mapping length for padded small packets (CVSS 7.5, Linux)
- [CVE-2026-99080](https://cve.now/CVE-2026-99080.md): fs: Free any excess xarray nodes in clear\_inode() (no CVSS, Linux)
- [CVE-2026-99079](https://cve.now/CVE-2026-99079.md): net/mlx5e: Prevent stale XSK buffer release on refill retry (CVSS 9.8, Linux)
- [CVE-2026-99078](https://cve.now/CVE-2026-99078.md): net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry (CVSS 9.8, Linux)
- [CVE-2026-99077](https://cve.now/CVE-2026-99077.md): ipv4: udp: Create exceptions before socket matching (CVSS 7.4, Linux)
- [CVE-2026-99076](https://cve.now/CVE-2026-99076.md): ipv6: udp: Create exceptions before socket matching (no CVSS, Linux)
- [CVE-2026-99075](https://cve.now/CVE-2026-99075.md): rust\_binder: reschedule node refcount update on thread exit (no CVSS, Linux)
- [CVE-2026-99074](https://cve.now/CVE-2026-99074.md): ipv4: stop PMTU walk when nexthop group shrinks (no CVSS, Linux)
- [CVE-2026-99073](https://cve.now/CVE-2026-99073.md): ipv4: stop exception dump when nexthop group shrinks (no CVSS, Linux)
- [CVE-2026-99072](https://cve.now/CVE-2026-99072.md): ipv4: stop route notification sizing when nexthop group shrinks (no CVSS, Linux)
- [CVE-2026-99071](https://cve.now/CVE-2026-99071.md): ipv4: do not warn on route notification size race (no CVSS, Linux)
- [CVE-2026-99070](https://cve.now/CVE-2026-99070.md): ipv6: do not warn on route notification size race (no CVSS, Linux)
- [CVE-2026-99069](https://cve.now/CVE-2026-99069.md): Input: ati\_remote2 - fix type confusion in device attribute handlers (no CVSS, Linux)
- [CVE-2026-99068](https://cve.now/CVE-2026-99068.md): ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers (no CVSS, Linux)
- [CVE-2026-99067](https://cve.now/CVE-2026-99067.md): btrfs: scrub: fix local\_root reference leak in scrub\_print\_warning\_inode() (no CVSS, Linux)
- [CVE-2026-99066](https://cve.now/CVE-2026-99066.md): can: dev: init\_can\_skb(): restore skb header initialization (no CVSS, Linux)
- [CVE-2026-99065](https://cve.now/CVE-2026-99065.md): cgroup/cpuset: Handle cpu hotplug race in guarantee\_active\_cpus() (no CVSS, Linux)
- [CVE-2026-99064](https://cve.now/CVE-2026-99064.md): cipso: adjust cached option offsets when removing CIPSO (CVSS 8.1, Linux)
- [CVE-2026-99063](https://cve.now/CVE-2026-99063.md): dm ioctl: don't let data\_start run past the buffer (no CVSS, Linux)
- [CVE-2026-99062](https://cve.now/CVE-2026-99062.md): vsock/virtio: account only unread bytes in read\_skb() (no CVSS, Linux)
- [CVE-2026-99061](https://cve.now/CVE-2026-99061.md): wifi: brcmfmac: fix P2P device removal race in brcmf\_detach() (no CVSS, Linux)
- [CVE-2026-99060](https://cve.now/CVE-2026-99060.md): wifi: mt76: mt7603: initialize global station WCID (no CVSS, Linux)
- [CVE-2026-99059](https://cve.now/CVE-2026-99059.md): wireguard: noise: reject response consumption after intermediate initiation (CVSS 7.7, Linux)
- [CVE-2026-99058](https://cve.now/CVE-2026-99058.md): workqueue: Fix NULL current\_pwq deref in chained work check (no CVSS, Linux)
- [CVE-2026-99057](https://cve.now/CVE-2026-99057.md): xen/netfront: don't leak the skb when xennet\_fill\_frags() fails (no CVSS, Linux)
- [CVE-2026-99056](https://cve.now/CVE-2026-99056.md): strparser: make sure \_\_strp\_recv isn't running before tearing down the parser (CVSS 7.8, Linux)
- [CVE-2026-99055](https://cve.now/CVE-2026-99055.md): tcp: reject net\_iov in zerocopy receive mapping hints (no CVSS, Linux)
- [CVE-2026-99054](https://cve.now/CVE-2026-99054.md): tipc: destroy topsrv workqueues before closing connections (CVSS 7.8, Linux)
- [CVE-2026-99053](https://cve.now/CVE-2026-99053.md): tipc: hold a reference to nodes found by link name (CVSS 7.8, Linux)
- [CVE-2026-99052](https://cve.now/CVE-2026-99052.md): selinux: preserve NATIVE\_LABELS on already-initialized sb in set\_mnt\_opts (no CVSS, Linux)
- [CVE-2026-99051](https://cve.now/CVE-2026-99051.md): fsverity: RCU-delay the freeing of struct fsverity\_info (CVSS 7.8, Linux)
- [CVE-2026-99050](https://cve.now/CVE-2026-99050.md): gpio: mpsse: fix race when arming the IRQ poll worker (CVSS 7.8, Linux)
- [CVE-2026-99049](https://cve.now/CVE-2026-99049.md): gpio: xilinx: fix runtime PM leak on request error path (no CVSS, Linux)
- [CVE-2026-99048](https://cve.now/CVE-2026-99048.md): gve: fix napi\_disable deadlock when attempting to disable XSK pools (no CVSS, Linux)
- [CVE-2026-99047](https://cve.now/CVE-2026-99047.md): gve: fix XSK buffer leak when rings are stopped (no CVSS, Linux)
- [CVE-2026-99046](https://cve.now/CVE-2026-99046.md): gve: fix XSK buffer leak on error descriptor (CVSS 7.5, Linux)
- [CVE-2026-99045](https://cve.now/CVE-2026-99045.md): ibmveth: h\_free logical LAN on open-fail after register (no CVSS, Linux)
- [CVE-2026-99044](https://cve.now/CVE-2026-99044.md): ice: fix use-after-free in dynamic port cleanup (no CVSS, Linux)
- [CVE-2026-99043](https://cve.now/CVE-2026-99043.md): ice: fix metadata\_dst refcount handling on representor teardown (no CVSS, Linux)
- [CVE-2026-99042](https://cve.now/CVE-2026-99042.md): io\_uring/net: populate CONNECT filter fields for 24-byte sockaddr\_in6 (CVSS 8.4, Linux)
- [CVE-2026-99041](https://cve.now/CVE-2026-99041.md): ip6\_gre: remove obsolete ERSPAN PMTU update (no CVSS, Linux)
- [CVE-2026-99040](https://cve.now/CVE-2026-99040.md): KEYS: Fix add\_key() race with keyring restriction (no CVSS, Linux)
- [CVE-2026-99039](https://cve.now/CVE-2026-99039.md): memstick: core: wait for request completion before freeing card (no CVSS, Linux)
- [CVE-2026-99038](https://cve.now/CVE-2026-99038.md): memstick: rtsx\_usb\_ms: complete requests after eject instead of dropping them (no CVSS, Linux)
- [CVE-2026-99037](https://cve.now/CVE-2026-99037.md): dm-crypt: reject the lmk IV mode with AEAD ciphers (no CVSS, Linux)
- [CVE-2026-99036](https://cve.now/CVE-2026-99036.md): dm: fix reading free memory in do\_resume (no CVSS, Linux)
- [CVE-2026-99035](https://cve.now/CVE-2026-99035.md): mmc: mtk-sd: Cancel request timeout work on remove (no CVSS, Linux)
- [CVE-2026-99034](https://cve.now/CVE-2026-99034.md): mmc: sdhci-sprd: disable runtime PM on remove (no CVSS, Linux)
- [CVE-2026-99033](https://cve.now/CVE-2026-99033.md): net/packet: guard the ll header push in packet\_rcv\_spkt() (no CVSS, Linux)
- [CVE-2026-99032](https://cve.now/CVE-2026-99032.md): net/smc: protect clcsock lifetime in smc\_getname (CVSS 7.8, Linux)
- [CVE-2026-99031](https://cve.now/CVE-2026-99031.md): net: bridge: avoid recursive multicast port cleanup (no CVSS, Linux)
- [CVE-2026-99030](https://cve.now/CVE-2026-99030.md): net: skbuff: don't leave stale bytes in skb\_copy\_and\_csum\_bits() (CVSS 7.5, Linux)
- [CVE-2026-99029](https://cve.now/CVE-2026-99029.md): net: sparx5: free the matchall entry on destroy (no CVSS, Linux)
- [CVE-2026-99028](https://cve.now/CVE-2026-99028.md): net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop (no CVSS, Linux)
- [CVE-2026-99027](https://cve.now/CVE-2026-99027.md): net: team: stop reusing skb after queue override (no CVSS, Linux)
- [CVE-2026-99026](https://cve.now/CVE-2026-99026.md): net: team: free skb when broadcast has no txable port (no CVSS, Linux)
- [CVE-2026-55422](https://cve.now/CVE-2026-55422.md): conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard (CVSS 4.6, conda-forge.github.io)
- [CVE-2026-99025](https://cve.now/CVE-2026-99025.md): openvswitch: fix soft lockup in the netlink flow dump (no CVSS, Linux)
- [CVE-2026-99024](https://cve.now/CVE-2026-99024.md): optee: register TEE devices only once fully initialized (no CVSS, Linux)
- [CVE-2026-99023](https://cve.now/CVE-2026-99023.md): power: sequencing: pcie-m2: Fix leaking array from of\_regulator\_bulk\_get\_all() (no CVSS, Linux)
- [CVE-2026-99022](https://cve.now/CVE-2026-99022.md): regulator: ltc3676: don't read the write-only HRST and CLIRQ registers (no CVSS, Linux)
- [CVE-2026-99021](https://cve.now/CVE-2026-99021.md): regulator: of: fill in supply names in of\_regulator\_bulk\_get\_all() (no CVSS, Linux)
- [CVE-2026-99020](https://cve.now/CVE-2026-99020.md): regulator: tps6594-regulator: Fix n\_linear\_ranges for TPS65224 BUCK2-4 (no CVSS, Linux)
- [CVE-2026-99019](https://cve.now/CVE-2026-99019.md): scsi: ch: Do not keep references to data transfer element devices (no CVSS, Linux)
- [CVE-2026-99018](https://cve.now/CVE-2026-99018.md): riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp (CVSS 7.8, Linux)
- [CVE-2026-99017](https://cve.now/CVE-2026-99017.md): riscv: errata: select RISCV\_ALTERNATIVE\_EARLY for THEAD GHOSTWRITE (CVSS 7.0, Linux)
- [CVE-2026-99016](https://cve.now/CVE-2026-99016.md): riscv: futex: untag the user pointer before the atomic access (CVSS 7.8, Linux)
- [CVE-2026-99015](https://cve.now/CVE-2026-99015.md): Bluetooth: hci\_sock: Serialize dead-device detachment (no CVSS, Linux)
- [CVE-2026-99014](https://cve.now/CVE-2026-99014.md): Bluetooth: hci\_sync: Fix command skb lifetime during scan setup (CVSS 7.8, Linux)
- [CVE-2026-99013](https://cve.now/CVE-2026-99013.md): Bluetooth: ISO: Reject concurrent BIS listener setup (CVSS 7.8, Linux)
- [CVE-2026-99012](https://cve.now/CVE-2026-99012.md): Bluetooth: ISO: Serialize concurrent connect calls (CVSS 7.8, Linux)
- [CVE-2026-99011](https://cve.now/CVE-2026-99011.md): Bluetooth: SCO: serialise sco\_conn lifetime against sco\_recv\_scodata() (CVSS 7.1, Linux)
- [CVE-2026-99010](https://cve.now/CVE-2026-99010.md): Bluetooth: RFCOMM: free the skb when the DLC has no owner (no CVSS, Linux)
- [CVE-2026-99009](https://cve.now/CVE-2026-99009.md): Bluetooth: RFCOMM: connect the session socket without rfcomm\_mutex (no CVSS, Linux)
- [CVE-2026-99008](https://cve.now/CVE-2026-99008.md): Bluetooth: RFCOMM: Fix NULL tty\_dev dereference in rfcomm\_dev\_shutdown (no CVSS, Linux)
- [CVE-2026-99007](https://cve.now/CVE-2026-99007.md): drm/fb-helper: defer setup when fbdev\_probe() fails, not just on -EAGAIN (no CVSS, Linux)
- [CVE-2026-99006](https://cve.now/CVE-2026-99006.md): drm/i915/gem: Prevent overstepping exec array boundary (CVSS 7.8, Linux)
- [CVE-2026-99005](https://cve.now/CVE-2026-99005.md): drm/i915/gt: Unmask interrupts only when ACTIVE is true (no CVSS, Linux)
- [CVE-2026-99004](https://cve.now/CVE-2026-99004.md): drm/imagination: Size page table preallocation by device address (no CVSS, Linux)
- [CVE-2026-99003](https://cve.now/CVE-2026-99003.md): drm/panthor: validate userspace queue count against initialized firmware slot count (no CVSS, Linux)
- [CVE-2026-99002](https://cve.now/CVE-2026-99002.md): drm/vmwgfx: validate pitch coming from userspace (CVSS 7.8, Linux)
- [CVE-2026-99001](https://cve.now/CVE-2026-99001.md): drm/xe/i2c: cancel the client work on remove (no CVSS, Linux)
- [CVE-2026-99000](https://cve.now/CVE-2026-99000.md): drm/xe: Fix shrinker accounting double-subtraction on nested external pins (no CVSS, Linux)
- [CVE-2026-98999](https://cve.now/CVE-2026-98999.md): drm/xe: Fix stale pinned\_link entry when fb-pin performs the final unpin (CVSS 7.8, Linux)
- [CVE-2026-98998](https://cve.now/CVE-2026-98998.md): drm/bridge: th1520-dw-hdmi: Fix remove() callback (no CVSS, Linux)
- [CVE-2026-98997](https://cve.now/CVE-2026-98997.md): drm/amdgpu/userq: only accept doorbell BOs as queue doorbell (no CVSS, Linux)
- [CVE-2026-98996](https://cve.now/CVE-2026-98996.md): fs: don't silently unmount busy mounts (no CVSS, Linux)
- [CVE-2026-98995](https://cve.now/CVE-2026-98995.md): namespace: reset the old parent's -\>overmount in mnt\_change\_mountpoint() (CVSS 7.8, Linux)
- [CVE-2026-98994](https://cve.now/CVE-2026-98994.md): statmount: read the parent of an unmounted mount under mount\_lock (no CVSS, Linux)
- [CVE-2026-98993](https://cve.now/CVE-2026-98993.md): namespace: don't inherit MNT\_UMOUNT in clone\_mnt() (CVSS 7.8, Linux)
- [CVE-2026-98992](https://cve.now/CVE-2026-98992.md): namespace: don't copy an unmounted mount tree (no CVSS, Linux)
- [CVE-2026-98991](https://cve.now/CVE-2026-98991.md): namespace: queue a mount only once for mount notifications (CVSS 7.8, Linux)
- [CVE-2026-98990](https://cve.now/CVE-2026-98990.md): namespace: check a submount for references right before unmounting it (no CVSS, Linux)
- [CVE-2026-98989](https://cve.now/CVE-2026-98989.md): namespace: check a recursive bind mount for mount namespace loops (no CVSS, Linux)
- [CVE-2026-98988](https://cve.now/CVE-2026-98988.md): namespace: keep covered mounts covered in OPEN\_TREE\_NAMESPACE (CVSS 8.8, Linux)
- [CVE-2026-98987](https://cve.now/CVE-2026-98987.md): namespace: look at the topmost mount for a mount namespace file (no CVSS, Linux)
- [CVE-2026-98986](https://cve.now/CVE-2026-98986.md): namespace: remove the fsnotify marks of a mount namespace in process context (no CVSS, Linux)
- [CVE-2026-98985](https://cve.now/CVE-2026-98985.md): namespace: check the mounts before reading their parents in pivot\_root() (no CVSS, Linux)
- [CVE-2026-98984](https://cve.now/CVE-2026-98984.md): dcache: don't put a mountpoint on a dentry that's being removed (no CVSS, Linux)
- [CVE-2026-98983](https://cve.now/CVE-2026-98983.md): unshare: don't drop active namespace references that were never taken (no CVSS, Linux)
- [CVE-2026-98982](https://cve.now/CVE-2026-98982.md): namespace: don't let a pseudo dentry become the root of a mount (CVSS 7.8, Linux)
- [CVE-2026-98981](https://cve.now/CVE-2026-98981.md): namespace: unhash a dentry before detaching the mounts on it (CVSS 8.8, Linux)
- [CVE-2026-98980](https://cve.now/CVE-2026-98980.md): namei: don't reveal overmounted entries in refwalk (CVSS 8.8, Linux)
- [CVE-2026-98979](https://cve.now/CVE-2026-98979.md): namespace: refuse an automount below a mount that is in no namespace (no CVSS, Linux)
- [CVE-2026-98978](https://cve.now/CVE-2026-98978.md): namespace: never expire a locked mount (CVSS 8.4, Linux)
- [CVE-2026-98977](https://cve.now/CVE-2026-98977.md): namespace: handle mount locking for automounts correctly (no CVSS, Linux)
- [CVE-2026-98976](https://cve.now/CVE-2026-98976.md): namespace: keep the lock on a mount that a propagated copy is moved beneath (CVSS 7.8, Linux)
- [CVE-2026-98975](https://cve.now/CVE-2026-98975.md): xfs: stop exchanging reflink flags when exchanging mappings (CVSS 7.8, Linux)
- [CVE-2026-98974](https://cve.now/CVE-2026-98974.md): xfs: fix exchange-range-to-eof file size exchange (CVSS 7.8, Linux)
- [CVE-2026-98973](https://cve.now/CVE-2026-98973.md): drm/bridge: Fix unlocked list\_del in drm\_bridge\_add() (no CVSS, Linux)
- [CVE-2026-98972](https://cve.now/CVE-2026-98972.md): cgroup/cpuset: Don't access cpuset\_cgrp\_subsys.root in is\_in\_v2\_mode() (no CVSS, Linux)
- [CVE-2026-98971](https://cve.now/CVE-2026-98971.md): gpio: exar: initialize the ID before registering its cleanup (no CVSS, Linux)
- [CVE-2026-98970](https://cve.now/CVE-2026-98970.md): drm/vc4: Free the BO cache size list on teardown (no CVSS, Linux)
- [CVE-2026-98969](https://cve.now/CVE-2026-98969.md): net/sched: em\_text: reject unterminated algo before autoload (no CVSS, Linux)
- [CVE-2026-98968](https://cve.now/CVE-2026-98968.md): amt: send the relay's General Query directly from the receive path (CVSS 8.1, Linux)
- [CVE-2026-98967](https://cve.now/CVE-2026-98967.md): cxgb4/ch\_ktls: disable softirqs around tid\_list erases (no CVSS, Linux)
- [CVE-2026-98966](https://cve.now/CVE-2026-98966.md): bonding: fix the program leak when XDP is replaced (no CVSS, Linux)
- [CVE-2026-98965](https://cve.now/CVE-2026-98965.md): ice: Restore Ordered MMIO Writes for Tx Doorbells (CVSS 7.5, Linux)
- [CVE-2026-98964](https://cve.now/CVE-2026-98964.md): nvmet: use the local P2P device on metadata allocation failure (CVSS 7.5, Linux)
- [CVE-2026-98963](https://cve.now/CVE-2026-98963.md): btrfs: always return -EIOCBQUEUED after btrfs\_uring\_read\_extent\_endio (no CVSS, Linux)
- [CVE-2026-98962](https://cve.now/CVE-2026-98962.md): btrfs: free iov when btrfs\_uring\_read\_extent() fails (no CVSS, Linux)
- [CVE-2026-98961](https://cve.now/CVE-2026-98961.md): btrfs: unlock inode and extent in caller when io\_uring read extent fails (no CVSS, Linux)
- [CVE-2026-98960](https://cve.now/CVE-2026-98960.md): btrfs: don't stash io\_uring encoded data across -EAGAIN (no CVSS, Linux)
- [CVE-2026-98959](https://cve.now/CVE-2026-98959.md): btrfs: fix xattr replace when multiple xattrs are packed in the same item (CVSS 9.8, Linux)
- [CVE-2026-98958](https://cve.now/CVE-2026-98958.md): wifi: mt76: account non-AQL frames per peer rather than per link (no CVSS, Linux)
- [CVE-2026-98957](https://cve.now/CVE-2026-98957.md): wifi: mt76: mt7915: disable rx napi when removing device (no CVSS, Linux)
- [CVE-2026-98956](https://cve.now/CVE-2026-98956.md): ASoC: adau1372: allow sleepy powerdown GPIOs (no CVSS, Linux)
- [CVE-2026-98955](https://cve.now/CVE-2026-98955.md): flow\_dissector: avoid u16 truncation of skb-\>len when computing thoff (no CVSS, Linux)
- [CVE-2026-98954](https://cve.now/CVE-2026-98954.md): net: always dissect GSO packets in \_\_virtio\_net\_hdr\_to\_skb() (no CVSS, Linux)
- [CVE-2026-98953](https://cve.now/CVE-2026-98953.md): devlink: fix devlink\_rel reference leak when notify work is pending (no CVSS, Linux)
- [CVE-2026-98952](https://cve.now/CVE-2026-98952.md): pfcp: make sure the SEID is linear before reading it (CVSS 7.3, Linux)
- [CVE-2026-98951](https://cve.now/CVE-2026-98951.md): riscv: ptrace: Zero-initialize regset buffers before copyin (no CVSS, Linux)
- [CVE-2026-98950](https://cve.now/CVE-2026-98950.md): flow\_dissector: avoid u16 truncation of hlen in bpf\_flow\_dissect() (no CVSS, Linux)
- [CVE-2026-98949](https://cve.now/CVE-2026-98949.md): drm/imagination: Fix reference and vm\_bo handling in remap() (no CVSS, Linux)
- [CVE-2026-98948](https://cve.now/CVE-2026-98948.md): mlxsw: spectrum\_flower: Fix port range register leak in tmplt\_create() (no CVSS, Linux)
- [CVE-2026-98947](https://cve.now/CVE-2026-98947.md): vsock: Fix memory leak in vmci\_transport\_recv\_dgram\_cb() (no CVSS, Linux)
- [CVE-2026-98946](https://cve.now/CVE-2026-98946.md): drm/vc4: Disable the V3D interrupt across runtime suspend (no CVSS, Linux)
- [CVE-2026-98945](https://cve.now/CVE-2026-98945.md): HID: steam: Rearrange teardown sequence (CVSS 7.8, Linux)
- [CVE-2026-98944](https://cve.now/CVE-2026-98944.md): HID: steam: Refactor registration (CVSS 7.8, Linux)
- [CVE-2026-54711](https://cve.now/CVE-2026-54711.md): PGHoard: Password written to debug log (CVSS 2.4, Aiven-Open pghoard · pghoard)
- [CVE-2026-63120](https://cve.now/CVE-2026-63120.md): PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write (CVSS 8.4, Aiven-Open pghoard)
- [CVE-2026-98942](https://cve.now/CVE-2026-98942.md): sched\_ext: Build the cid tables privately and publish them with RCU (no CVSS, Linux)
- [CVE-2026-98941](https://cve.now/CVE-2026-98941.md): ext4: don't enable large folios on encrypted inodes (CVSS 7.0, Linux)
- [CVE-2026-98940](https://cve.now/CVE-2026-98940.md): ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (no CVSS, Linux)
- [CVE-2026-98939](https://cve.now/CVE-2026-98939.md): x86/mm: Drop unnecessary PMD page copy when freeing (no CVSS, Linux)
- [CVE-2026-98938](https://cve.now/CVE-2026-98938.md): rust: irq: pass RegistrationInner as cookie to request\_irq (no CVSS, Linux)
- [CVE-2026-98937](https://cve.now/CVE-2026-98937.md): perf/core: Check kernel access when kernel callchains are requested (no CVSS, Linux)
- [CVE-2026-98936](https://cve.now/CVE-2026-98936.md): wifi: ath11k: reset ar-\>num\_stations on hardware start (no CVSS, Linux)
- [CVE-2026-98935](https://cve.now/CVE-2026-98935.md): rtc: dev: zero-initialize struct rtc\_wkalrm to prevent information leak (no CVSS, Linux)
- [CVE-2026-98934](https://cve.now/CVE-2026-98934.md): ipv6: sr: use skb\_get\_hash\_net() in seg6\_make\_flowlabel() (no CVSS, Linux)
- [CVE-2026-98933](https://cve.now/CVE-2026-98933.md): usb: hub: use shorter 120ms post resume hold for SS root hubs (no CVSS, Linux)
- [CVE-2026-98932](https://cve.now/CVE-2026-98932.md): EDAC/altera: Fix use-after-free in error paths (CVSS 7.4, Linux)
- [CVE-2026-98931](https://cve.now/CVE-2026-98931.md): mtd: spinand: fix NULL pointer dereference with no ECC engine (no CVSS, Linux)
- [CVE-2026-57117](https://cve.now/CVE-2026-57117.md): PraisonAI: Compute-bridged file tools allow shell command injection (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-98930](https://cve.now/CVE-2026-98930.md): KVM: s390: Fix IRQ injection with SIGP Stop and Store Status (no CVSS, Linux)
- [CVE-2026-57146](https://cve.now/CVE-2026-57146.md): PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default (CVSS 7.5, MervinPraison PraisonAI)
- [CVE-2026-98929](https://cve.now/CVE-2026-98929.md): macsec: initialize SecY before registering the netdevice (no CVSS, Linux)
- [CVE-2026-98928](https://cve.now/CVE-2026-98928.md): KVM: arm64: Derive GUEST\_HAS\_SVE from the SVE feature bit at EL2 (no CVSS, Linux)
- [CVE-2026-57144](https://cve.now/CVE-2026-57144.md): PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable (CVSS 8.8, MervinPraison PraisonAI)
- [CVE-2026-57142](https://cve.now/CVE-2026-57142.md): PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml (CVSS 7.8, MervinPraison PraisonAI)
- [CVE-2026-57121](https://cve.now/CVE-2026-57121.md): PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API (CVSS 8.1, MervinPraison PraisonAI · praisonai-platform)
- [CVE-2026-57116](https://cve.now/CVE-2026-57116.md): PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-98927](https://cve.now/CVE-2026-98927.md): KVM: arm64: nv: Fix life cycle of the nested\_mmus array (CVSS 7.0, Linux)
- [CVE-2026-98926](https://cve.now/CVE-2026-98926.md): drm/amd/display: Remove sink usage from DPMS (no CVSS, Linux)
- [CVE-2026-98925](https://cve.now/CVE-2026-98925.md): bpf, sockmap: Fix self-redirect copied\_seq double-counting (no CVSS, Linux)
- [CVE-2026-57114](https://cve.now/CVE-2026-57114.md): PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding (CVSS 7.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57113](https://cve.now/CVE-2026-57113.md): PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion (CVSS 8.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-98924](https://cve.now/CVE-2026-98924.md): fs: avoid repeated scans in evict\_inodes() (no CVSS, Linux)
- [CVE-2026-98923](https://cve.now/CVE-2026-98923.md): arm64: io: Reject non-user protection in ioremap\_prot() (no CVSS, Linux)
- [CVE-2026-98922](https://cve.now/CVE-2026-98922.md): net: emac: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-98921](https://cve.now/CVE-2026-98921.md): ovl: fix UAF in ovl\_do\_mkdir() debug print (no CVSS, Linux)
- [CVE-2026-98920](https://cve.now/CVE-2026-98920.md): netfs: Fix missing alloc tagging of direct mempool allocations (no CVSS, Linux)
- [CVE-2026-98919](https://cve.now/CVE-2026-98919.md): drm/xe: harden adjust\_idledly() against divide-by-zero and overflow (no CVSS, Linux)
- [CVE-2026-98918](https://cve.now/CVE-2026-98918.md): mm/damon/ops-common: use a page-aligned address in damon\_ptep\_mkold() (no CVSS, Linux)
- [CVE-2026-98917](https://cve.now/CVE-2026-98917.md): parisc: Increase kernel stack size to 32kb (no CVSS, Linux)
- [RUSTSEC-2026-0387](https://cve.now/RUSTSEC-2026-0387.md): Multiple timing variability issues in operations intended to be constant-time (no CVSS, crypto-bigint)
- [CVE-2026-56840](https://cve.now/CVE-2026-56840.md): PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56838](https://cve.now/CVE-2026-56838.md): PraisonAI recipe.run\_stream skips dangerous-tool policy enforcement (CVSS 7.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56837](https://cve.now/CVE-2026-56837.md): PraisonAI LinearBot processes unsigned webhooks when LINEAR\_WEBHOOK\_SECRET is missing (CVSS 8.6, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56836](https://cve.now/CVE-2026-56836.md): PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard (CVSS 8.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56835](https://cve.now/CVE-2026-56835.md): PraisonAI Slack app\_mention bypasses configured user/channel authorization (CVSS 8.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56834](https://cve.now/CVE-2026-56834.md): PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56833](https://cve.now/CVE-2026-56833.md): PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56832](https://cve.now/CVE-2026-56832.md): PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-98916](https://cve.now/CVE-2026-98916.md): wifi: nl80211: check link is beaconing for color change (no CVSS, Linux)
- [CVE-2026-98915](https://cve.now/CVE-2026-98915.md): media: video-i2c: use vb2\_video\_unregister\_device on driver removal (no CVSS, Linux)
- [CVE-2026-98914](https://cve.now/CVE-2026-98914.md): drm/amdgpu: cap ATOM command table nesting depth (no CVSS, Linux)
- [CVE-2026-98913](https://cve.now/CVE-2026-98913.md): net: thunderx: fix PTP device ref leak in nicvf\_probe() (no CVSS, Linux)
- [CVE-2026-98912](https://cve.now/CVE-2026-98912.md): ALSA: seq: oss: Reject reads that cannot fit the next event (no CVSS, Linux)
- [CVE-2026-98911](https://cve.now/CVE-2026-98911.md): dpaa2-switch: fix the error path in dpaa2\_switch\_rx() (CVSS 7.5, Linux)
- [CVE-2026-98910](https://cve.now/CVE-2026-98910.md): drm/amdkfd: Unwind debug trap enable on copy\_to\_user failure (no CVSS, Linux)
- [CVE-2026-98909](https://cve.now/CVE-2026-98909.md): net: cpsw\_new: unregister devlink on port registration failure (no CVSS, Linux)
- [CVE-2026-98908](https://cve.now/CVE-2026-98908.md): net: microchip: sparx5: clean up PSFP resources on flower setup failure (no CVSS, Linux)
- [CVE-2026-98907](https://cve.now/CVE-2026-98907.md): btrfs: protect sb\_write\_pointer() with invalidate lock (no CVSS, Linux)
- [CVE-2026-98906](https://cve.now/CVE-2026-98906.md): net: lan966x: restore RX state on reload failure (no CVSS, Linux)
- [CVE-2026-98905](https://cve.now/CVE-2026-98905.md): drm/amdkfd: Properly acquire queue buffers in CRIU restore (no CVSS, Linux)
- [CVE-2026-98904](https://cve.now/CVE-2026-98904.md): mailbox: imx: Use devm\_pm\_runtime\_enable() (no CVSS, Linux)
- [CVE-2026-98903](https://cve.now/CVE-2026-98903.md): mailbox: imx: Add a channel shutdown field (no CVSS, Linux)
- [CVE-2026-98902](https://cve.now/CVE-2026-98902.md): md/raid5: let stripe batch bm\_seq comparison wrap-safe (no CVSS, Linux)
- [CVE-2026-98901](https://cve.now/CVE-2026-98901.md): ksmbd: fix lease break and ack state handling (no CVSS, Linux)
- [CVE-2026-98900](https://cve.now/CVE-2026-98900.md): xen/gntalloc: validate grant count before allocation (no CVSS, Linux)
- [CVE-2026-98899](https://cve.now/CVE-2026-98899.md): netfilter: ipset: mark the rcu locked areas properly (CVSS 7.8, Linux)
- [CVE-2026-98898](https://cve.now/CVE-2026-98898.md): drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (no CVSS, Linux)
- [CVE-2026-98897](https://cve.now/CVE-2026-98897.md): ksmbd: don't hold ci-\>m\_lock while waiting for a lease break ack (no CVSS, Linux)
- [CVE-2026-112904](https://cve.now/CVE-2026-112904.md): Vvveb: Path Traversal in nextRestore() and nextBackup() (CVSS 8.7, givanz Vvveb)
- [CVE-2026-98896](https://cve.now/CVE-2026-98896.md): thunderbolt: Keep the domain reference while processing hotplug (no CVSS, Linux)
- [CVE-2026-98895](https://cve.now/CVE-2026-98895.md): net/mlx5: HWS, Handle destroying table that has a miss table (CVSS 7.0, Linux)
- [CVE-2026-98894](https://cve.now/CVE-2026-98894.md): drm/amd/ras: reset CPER ring on corrupt entry size (no CVSS, Linux)
- [CVE-2026-98893](https://cve.now/CVE-2026-98893.md): firmware: arm\_scmi: Validate SENSOR\_UPDATE payload size (no CVSS, Linux)
- [CVE-2026-98892](https://cve.now/CVE-2026-98892.md): firmware: arm\_scmi: Validate BASE\_ERROR\_EVENT payload size (no CVSS, Linux)
- [CVE-2026-98891](https://cve.now/CVE-2026-98891.md): wifi: mac80211: validate deauth frame length before reason access (no CVSS, Linux)
- [CVE-2026-98890](https://cve.now/CVE-2026-98890.md): wifi: libertas: reject short monitor TX frames (no CVSS, Linux)
- [CVE-2026-98889](https://cve.now/CVE-2026-98889.md): wifi: iwlwifi: mvm: fix sched scan IE sizing (CVSS 7.8, Linux)
- [CVE-2026-98888](https://cve.now/CVE-2026-98888.md): arm64: kprobes: Allow reentering kprobes while single-stepping (no CVSS, Linux)
- [CVE-2026-98887](https://cve.now/CVE-2026-98887.md): wifi: mac80211\_hwsim: reject undersized HWSIM\_ATTR\_TX\_INFO (no CVSS, Linux)
- [CVE-2026-98886](https://cve.now/CVE-2026-98886.md): drm/gma500: return errors from Oaktrail HDMI I2C reads (no CVSS, Linux)
- [CVE-2026-98885](https://cve.now/CVE-2026-98885.md): ima: return error early if file xattr cannot be changed (no CVSS, Linux)
- [CVE-2026-98884](https://cve.now/CVE-2026-98884.md): mmc: core: Add validation for host-provided max\_segs (no CVSS, Linux)
- [CVE-2026-98883](https://cve.now/CVE-2026-98883.md): serial: 8250\_port: recognize UPIO\_AU (no CVSS, Linux)
- [CVE-2026-98882](https://cve.now/CVE-2026-98882.md): media: chips-media: wave5: Add range checks for dec\_output\_info (no CVSS, Linux)
- [CVE-2026-98881](https://cve.now/CVE-2026-98881.md): net: bridge: remove stale rcu\_barrier() in br\_multicast\_dev\_del() (no CVSS, Linux)
- [CVE-2026-98880](https://cve.now/CVE-2026-98880.md): ntfs3: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-98879](https://cve.now/CVE-2026-98879.md): isofs: handle set\_blocksize failures (no CVSS, Linux)
- [CVE-2026-98878](https://cve.now/CVE-2026-98878.md): irqchip/gic-v5: Immediately exec priority drop following activate (no CVSS, Linux)
- [CVE-2026-98877](https://cve.now/CVE-2026-98877.md): irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (no CVSS, Linux)
- [CVE-2026-98876](https://cve.now/CVE-2026-98876.md): host1x: bus: Fix missing ops null check in error teardown (no CVSS, Linux)
- [CVE-2026-98875](https://cve.now/CVE-2026-98875.md): drm/nouveau/gsp: add SEC2 to GA100 chip table (no CVSS, Linux)
- [CVE-2026-98874](https://cve.now/CVE-2026-98874.md): wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect (no CVSS, Linux)
- [CVE-2026-98873](https://cve.now/CVE-2026-98873.md): netfilter: nf\_conntrack\_expect: zero at allocation time (no CVSS, Linux)
- [CVE-2026-98872](https://cve.now/CVE-2026-98872.md): freevxfs: don't BUG() on unknown typed-extent type (no CVSS, Linux)
- [CVE-2026-98871](https://cve.now/CVE-2026-98871.md): crypto: ccp - Fix possible deadlock in SEV init failure path (no CVSS, Linux)
- [CVE-2026-98870](https://cve.now/CVE-2026-98870.md): ksmbd: remove stale channels from all sessions on teardown (CVSS 8.8, Linux)
- [CVE-2026-115727](https://cve.now/CVE-2026-115727.md): AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm\_server (CVSS 9.2, Fosowl AgenticSeek)
- [CVE-2026-115726](https://cve.now/CVE-2026-115726.md): Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings (CVSS 8.5, Aider-AI aider)
- [CVE-2026-115725](https://cve.now/CVE-2026-115725.md): Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source\_id (CVSS 2.3, chatwoot)
- [CVE-2026-115724](https://cve.now/CVE-2026-115724.md): VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider (CVSS 2.1, VideoLAN VLC for Android)
- [CVE-2026-115723](https://cve.now/CVE-2026-115723.md): Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion (CVSS 8.3, davenardella snap7)
- [CVE-2026-115722](https://cve.now/CVE-2026-115722.md): RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header (CVSS 6.9, diegonehab rply)
- [CVE-2026-107685](https://cve.now/CVE-2026-107685.md): WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers (CVSS 9.1, agentjido req\_llm · req\_llm)
- [CVE-2026-95620](https://cve.now/CVE-2026-95620.md): Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt (CVSS 2.1, qt)
- [CVE-2026-94263](https://cve.now/CVE-2026-94263.md): Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message (CVSS 4.8, Advanced Custom Fields: Extended)
- [CVE-2026-111965](https://cve.now/CVE-2026-111965.md): Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass (CVSS 4.3, Profile Builder)
- [CVE-2026-105963](https://cve.now/CVE-2026-105963.md): Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments (CVSS 5.1, elixir-plug plug · elixir-plug plug\_crypto +2)
- [CVE-2026-16762](https://cve.now/CVE-2026-16762.md): Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt (CVSS 8.7, qt)
- [CVE-2026-89320](https://cve.now/CVE-2026-89320.md): HmacShaCryptor.Hash never hashes its input — returns constant HMAC\_K("") for all inputs, voiding CBC-HMAC JWE integrity (CVSS 8.8, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-25784](https://cve.now/CVE-2026-25784.md): bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop (CVSS 9.3, Hallo Welt! BlueSpice)
- [CVE-2026-89319](https://cve.now/CVE-2026-89319.md): JweDirectDecryptorBlock.Decrypt: unchecked \_thales\_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation (CVSS 6.3, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-25716](https://cve.now/CVE-2026-25716.md): BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users (CVSS 7.1, Hallo Welt! BlueSpice)
- [CVE-2026-89318](https://cve.now/CVE-2026-89318.md): JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) (CVSS 6.9, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-89317](https://cve.now/CVE-2026-89317.md): JwtVerifierImpl.Verify does not enforce the JWS \`crit\` header (RFC 7515 §4.1.11) (CVSS 6.3, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-89316](https://cve.now/CVE-2026-89316.md): LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked \*ECDSAOptions type assertion (CVSS 6.3, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-89315](https://cve.now/CVE-2026-89315.md): JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix (CVSS 6.9, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-89314](https://cve.now/CVE-2026-89314.md): Quadratic-time key\_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s (CVSS 6.9, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-89313](https://cve.now/CVE-2026-89313.md): JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil (CVSS 6.3, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2026-89312](https://cve.now/CVE-2026-89312.md): AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV (CVSS 6.9, Eclipse Foundation Eclipse KeyPont - GOSE)
- [CVE-2025-58403](https://cve.now/CVE-2025-58403.md): Reflected Cross-Site Scripting (XSS) in CGM CLININET (CVSS 5.1, CGM CLININET)
- [CVE-2025-30054](https://cve.now/CVE-2025-30054.md): Local Privilege Escalation in CGM CLININET (CVSS 9.3, CGM CLININET)
- [CVE-2025-30053](https://cve.now/CVE-2025-30053.md): Missing Authentication in CGM CLININET (CVSS 6.9, CGM CLININET)
- [CVE-2025-30052](https://cve.now/CVE-2025-30052.md): Authentication Bypass via IP Spoofing in CGM CLININET rsyncd (CVSS 8.8, CGM CLININET)
- [CVE-2025-30051](https://cve.now/CVE-2025-30051.md): Insecure File Permissions in CGM CLININET (CVSS 6.8, CGM CLININET)
- [CVE-2025-30050](https://cve.now/CVE-2025-30050.md): Remote Code Execution in CGM CLININET (CVSS 9.4, CGM CLININET)
- [CVE-2025-30049](https://cve.now/CVE-2025-30049.md): Use of Unsalted MD5 Password Hashes in CGM CLININET (CVSS 8.2, CGM CLININET)
- [CVE-2025-30047](https://cve.now/CVE-2025-30047.md): Remote Code Execution via Java Deserialization in CGM CLININET (CVSS 9.4, CGM CLININET)
- [CVE-2025-30046](https://cve.now/CVE-2025-30046.md): Remote Code Execution in CGM CLININET (CVSS 9.0, CGM CLININET)
- [CVE-2025-30045](https://cve.now/CVE-2025-30045.md): Code Injection in CGM CLININET (CVSS 8.6, CGM CLININET)
- [CVE-2025-30043](https://cve.now/CVE-2025-30043.md): Missing Authentication in CGM CLININET (CVSS 7.1, CGM CLININET)
- [CVE-2026-115657](https://cve.now/CVE-2026-115657.md): KNIME Analytics Platform logs credentials of configured proxy when used as an executor (CVSS 4.8, KNIME Analytics Platform)
- [CVE-2026-112860](https://cve.now/CVE-2026-112860.md): WordPress Participants Database plugin \<= 2.7.8.5 - SQL Injection vulnerability (CVSS 9.3, xnau webdesign Participants Database)
- [CVE-2026-112862](https://cve.now/CVE-2026-112862.md): WordPress Participants Database plugin \<= 2.7.8.5 - PHP Object Injection vulnerability (CVSS 9.8, xnau webdesign Participants Database)
- [CVE-2026-112835](https://cve.now/CVE-2026-112835.md): WordPress VikRentCar plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikRentCar)
- [CVE-2026-112837](https://cve.now/CVE-2026-112837.md): WordPress GamiPress plugin \<= 8.0.7 - SQL Injection vulnerability (CVSS 8.5, Ruben Garcia GamiPress)
- [CVE-2026-112359](https://cve.now/CVE-2026-112359.md): WordPress WPMobile.App plugin \<= 11.86 - Broken Access Control vulnerability (CVSS 7.5, Amauri.IO WPMobile.App)
- [CVE-2026-112838](https://cve.now/CVE-2026-112838.md): WordPress VikRentCar plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikRentCar)
- [CVE-2026-112821](https://cve.now/CVE-2026-112821.md): WordPress Knit Pay plugin \<= 9.6.3.0 - Broken Access Control vulnerability (CVSS 6.5, Knit Pay)
- [CVE-2026-112825](https://cve.now/CVE-2026-112825.md): WordPress Car Rental Manager plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 6.5, Magepeople Car Rental Manager)
- [CVE-2026-4952](https://cve.now/CVE-2026-4952.md): Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem (CVSS 5.1, VertiGIS WebOrderSystem)
- [CVE-2026-4951](https://cve.now/CVE-2026-4951.md): Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem (CVSS 5.1, VertiGIS WebOrderSystem)
- [CVE-2026-4950](https://cve.now/CVE-2026-4950.md): Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem (CVSS 4.8, VertiGIS WebOrderSystem)
- [CVE-2026-63244](https://cve.now/CVE-2026-63244.md): Authentication Bypass Vulnerability (CVSS 9.8, WizLearn Technologies Pte. Learning Management System)
- [CVE-2026-75775](https://cve.now/CVE-2026-75775.md): Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands w (CVSS 7.7, ASUS Router)
- [CVE-2026-93489](https://cve.now/CVE-2026-93489.md): Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket… (CVSS 8.7, ASUS Router)
- [CVE-2026-75779](https://cve.now/CVE-2026-75779.md): Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS (CVSS 8.6, ASUS Router)
- [CVE-2026-63243](https://cve.now/CVE-2026-63243.md): Firmware verification vulnerability (CVSS 4.3, Creative Labs Creative Sound Blaster Katana V2, V2X, SE)
- [CVE-2026-55981](https://cve.now/CVE-2026-55981.md): Firmware verification vulnerability (CVSS 9.6, Creative Labs Creative Sound Blaster Katana V2, V2X, SE)
- [CVE-2026-94268](https://cve.now/CVE-2026-94268.md): Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action (CVSS 8.1, Advanced Custom Fields: Extended)
- [CVE-2026-94267](https://cve.now/CVE-2026-94267.md): Advanced Custom Fields: Extended \< 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action (CVSS 9.0, Advanced Custom Fields: Extended)
- [CVE-2026-94264](https://cve.now/CVE-2026-94264.md): Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes (CVSS 6.8, Advanced Custom Fields: Extended)
- [CVE-2026-94262](https://cve.now/CVE-2026-94262.md): Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action (CVSS 8.1, Advanced Custom Fields: Extended)
- [CVE-2026-113501](https://cve.now/CVE-2026-113501.md): LiteSpeed Cache \< 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal (CVSS 3.1, LiteSpeed Cache)
- [CVE-2026-113500](https://cve.now/CVE-2026-113500.md): LiteSpeed Cache \< 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization (CVSS 7.5, LiteSpeed Cache)
- [CVE-2026-113499](https://cve.now/CVE-2026-113499.md): LiteSpeed Cache \< 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting (CVSS 7.5, LiteSpeed Cache)
- [CVE-2026-113472](https://cve.now/CVE-2026-113472.md): Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload (CVSS 5.4, Depicter — Popup & Slider Builder)
- [CVE-2026-112230](https://cve.now/CVE-2026-112230.md): Popup Builder \< 4.4.6 - Unauthenticated Popup Trashing via post\_type Parameter (CVSS 3.7, Popup Builder)
- [CVE-2026-112219](https://cve.now/CVE-2026-112219.md): Download Monitor \< 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route (CVSS 4.9, Download Monitor)
- [CVE-2026-111982](https://cve.now/CVE-2026-111982.md): Profile Builder \< 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change (CVSS 7.2, User Profile Builder)
- [CVE-2026-111966](https://cve.now/CVE-2026-111966.md): Profile Builder \< 4.0.5 - Contributor+ Stored XSS via redirect\_url Shortcode Attribute (CVSS 6.8, User Profile Builder)
- [CVE-2026-111738](https://cve.now/CVE-2026-111738.md): Speed Optimizer \< 7.8.5 - Admin+ Network Option Update via enable-option/disable-option (CVSS 5.5, Speed Optimizer)
- [CVE-2026-111737](https://cve.now/CVE-2026-111737.md): Speed Optimizer \< 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists (CVSS 3.5, Speed Optimizer)
- [CVE-2026-110537](https://cve.now/CVE-2026-110537.md): Essential Addons for Elementor \< 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action (CVSS 3.8, Essential Addons for Elementor)
- [CVE-2026-110510](https://cve.now/CVE-2026-110510.md): Essential Addons for Elementor \< 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag (CVSS 3.5, Essential Addons for Elementor)
- [CVE-2026-109936](https://cve.now/CVE-2026-109936.md): Otter Blocks \< 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter (CVSS 7.5, Otter Blocks)
- [CVE-2026-109935](https://cve.now/CVE-2026-109935.md): Otter Blocks \< 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API (CVSS 5.3, Otter Blocks)
- [CVE-2026-109934](https://cve.now/CVE-2026-109934.md): Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API (CVSS 5.3, Otter Blocks)
- [CVE-2026-109933](https://cve.now/CVE-2026-109933.md): Otter Blocks \< 3.2.8 - Contributor+ Stored XSS via Block Style Attributes (CVSS 6.8, Otter Blocks)
- [CVE-2026-107858](https://cve.now/CVE-2026-107858.md): Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server (CVSS 7.2, Google Agent Development Kit (ADK) for Java)
- [CVE-2026-109198](https://cve.now/CVE-2026-109198.md): Anti-Spam by CleanTalk \<= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user\_email' Registration Parameter (CVSS 7.2, CleanTalk Anti-Spam – Complete Spam Protection)
- [CVE-2026-115497](https://cve.now/CVE-2026-115497.md): Music Store \<= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter (CVSS 7.5, codepeople Music Store – WordPress eCommerce)
- [CVE-2026-55835](https://cve.now/CVE-2026-55835.md): Lookyloo: Potential sub-system DoS due to parameter missmatch in notification (CVSS 6.9, lookyloo)
- [CVE-2026-86055](https://cve.now/CVE-2026-86055.md): Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover (CVSS 8.7, Part-DB-server)
- [CVE-2026-86020](https://cve.now/CVE-2026-86020.md): Part-DB: Spreadsheet Formula Injection in XLSX Part Exports (CVSS 4.6, Part-DB-server)
- [CVE-2026-86019](https://cve.now/CVE-2026-86019.md): Part-DB: Attachment Size Limit Bypass via API Base64 Upload (CVSS 5.3, Part-DB-server)
- [CVE-2026-86018](https://cve.now/CVE-2026-86018.md): Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads (CVSS 5.3, Part-DB-server)
- [CVE-2026-59188](https://cve.now/CVE-2026-59188.md): Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer (CVSS 5.4, Part-DB-server)
- [CVE-2026-55600](https://cve.now/CVE-2026-55600.md): Part-DB: Stored HTML injection in BOM validation results via unescaped Part name (CVSS 5.7, Part-DB-server)
- [CVE-2026-54631](https://cve.now/CVE-2026-54631.md): Part-DB: Hardcoded APP\_SECRET enables forged remember-me cookie (CVSS 6.3, Part-DB-server)
- [CVE-2026-90458](https://cve.now/CVE-2026-90458.md): OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor\_passthru, e.g., to delete accounts from the BMC's Redfish service. (CVSS 5.4, OpenStack Ironic)
- [CVE-2026-54630](https://cve.now/CVE-2026-54630.md): Part-DB: Authenticated RCE via .phar attachment upload served from public/media (CVSS 9.6, Part-DB-server)
- [CVE-2026-54615](https://cve.now/CVE-2026-54615.md): Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) (CVSS 6.0, Part-DB-server)
- [CVE-2026-89419](https://cve.now/CVE-2026-89419.md): OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other (CVSS 5.0, OpenStack Ironic)
- [CVE-2026-115638](https://cve.now/CVE-2026-115638.md): OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a (CVSS 4.3, OpenStack Ironic)
- [CVE-2026-115547](https://cve.now/CVE-2026-115547.md): Command Execution via Admin Console Input in Okta Access Gateway (CVSS 9.1, Okta Access Gateway)
- [CVE-2026-115546](https://cve.now/CVE-2026-115546.md): Authentication Source Verification Issue in Okta Access Gateway (CVSS 8.1, Okta Access Gateway)
- [CVE-2026-115537](https://cve.now/CVE-2026-115537.md): gedelumbung HospitalManagement URL Validation routing\_pages.php simpan redirect (CVSS 5.3, gedelumbung HospitalManagement)
- [CVE-2026-19678](https://cve.now/CVE-2026-19678.md): Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure (CVSS 8.7, onPhase Forms)
- [CVE-2026-19677](https://cve.now/CVE-2026-19677.md): Authentication Bypass Leading to Server-Side Command Execution (CVSS 9.3, onPhase Forms)
- [CVE-2026-115536](https://cve.now/CVE-2026-115536.md): gedelumbung HospitalManagement Admin Routing routing\_pages.php simpan cross site scripting (CVSS 5.3, gedelumbung HospitalManagement)
- [CVE-2026-115486](https://cve.now/CVE-2026-115486.md): Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-115485](https://cve.now/CVE-2026-115485.md): Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio (CVSS 6.3, Red Hat Enterprise Linux)
- [CVE-2026-115484](https://cve.now/CVE-2026-115484.md): Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse\_msg (CVSS 7.6, Red Hat Enterprise Linux)
- [CVE-2026-115535](https://cve.now/CVE-2026-115535.md): gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting (CVSS 4.8, gedelumbung HospitalManagement)
- [CVE-2025-45528](https://cve.now/CVE-2025-45528.md): An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF (CVSS 7.3)
- [CVE-2026-106763](https://cve.now/CVE-2026-106763.md): An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and… (CVSS 7.5, @justice8096/sagemath-mcp-server)
- [CVE-2026-106764](https://cve.now/CVE-2026-106764.md): An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. (CVSS 7.5, @rog0x/mcp-git-tools)
- [CVE-2026-106765](https://cve.now/CVE-2026-106765.md): An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. (CVSS 7.5, @rog0x/mcp-docker-tools)
- [CVE-2026-50787](https://cve.now/CVE-2026-50787.md): e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. (CVSS 7.5)
- [CVE-2026-52356](https://cve.now/CVE-2026-52356.md): An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1\_FW101WWb04 allows attackers to execut (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.