# CVEs published 2026-10-28

634 CVEs were published on October 28, 2026: 35 critical, 216 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-118589](https://cve.now/CVE-2026-118589.md): nschloe meshio VTK Reader \_vtk\_42.py memory allocation (CVSS 6.9, nschloe meshio)
- [CVE-2026-118586](https://cve.now/CVE-2026-118586.md): dfm feedfinder2 feedfinder2.py find\_feeds server-side request forgery (CVSS 6.9, dfm feedfinder2)
- [CVE-2026-118585](https://cve.now/CVE-2026-118585.md): configuroweb inventariobasico Add Product addlist.php cross site scripting (CVSS 5.1, configuroweb inventariobasico)
- [CVE-2026-86983](https://cve.now/CVE-2026-86983.md): A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its lengt (no CVSS, Apple swift-crypto)
- [CVE-2026-118579](https://cve.now/CVE-2026-118579.md): D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor (CVSS 9.3, D-Link DIR-505)
- [CVE-2026-118578](https://cve.now/CVE-2026-118578.md): maotoumao MusicFreeDesktop Request Forwarder information disclosure (CVSS 5.3, maotoumao MusicFreeDesktop)
- [CVE-2026-82411](https://cve.now/CVE-2026-82411.md): Objects API: Cross-object-type authorization bypass on the object history-detail endpoint (CVSS 6.5, maykinmedia open-object)
- [CVE-2026-85749](https://cve.now/CVE-2026-85749.md): MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail (CVSS 8.1, MailWatch)
- [CVE-2026-55561](https://cve.now/CVE-2026-55561.md): InvoicePlane: Guest user IDOR in quote approval and rejection (CVSS 5.3, InvoicePlane)
- [CVE-2026-75520](https://cve.now/CVE-2026-75520.md): Domoticz: Missing authorization and path traversal in the udevices Lua parser handler (CVSS 5.4, domoticz)
- [CVE-2026-118577](https://cve.now/CVE-2026-118577.md): maotoumao MusicFreeDesktop Request Forwarder server-side request forgery (CVSS 5.3, maotoumao MusicFreeDesktop)
- [CVE-2026-118538](https://cve.now/CVE-2026-118538.md): a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes (CVSS 5.1, a2ui-project a2ui)
- [CVE-2026-61575](https://cve.now/CVE-2026-61575.md): AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles (CVSS 4.7, WWBN AVideo-Encoder)
- [CVE-2026-61569](https://cve.now/CVE-2026-61569.md): AVideo-Encoder: pre-authentication streamer-login SQL injection (CVSS 7.5, WWBN AVideo-Encoder)
- [CVE-2026-54453](https://cve.now/CVE-2026-54453.md): OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional) (CVSS 7.2, OpenCATS)
- [CVE-2026-61571](https://cve.now/CVE-2026-61571.md): AVideo-Encoder: missing authentication on control and status endpoints (CVSS 7.3, WWBN AVideo-Encoder)
- [CVE-2026-116641](https://cve.now/CVE-2026-116641.md): The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs (CVSS 7.6, MongoDB Database Tools)
- [CVE-2026-61572](https://cve.now/CVE-2026-61572.md): AVideo-Encoder: unauthenticated full-response server-side request forgery (CVSS 8.6, WWBN AVideo-Encoder)
- [CVE-2026-61573](https://cve.now/CVE-2026-61573.md): AVideo-Encoder: reflected cross-site scripting in the login interface (CVSS 6.1, WWBN AVideo-Encoder)
- [CVE-2026-118537](https://cve.now/CVE-2026-118537.md): a2ui Image Player/Video Player/Audio Player Image.js input validation (CVSS 5.3, a2ui)
- [CVE-2026-54455](https://cve.now/CVE-2026-54455.md): OpenCATS: Authenticated SQL injection in activity DataGrid date filters (CVSS 7.6, OpenCATS)
- [CVE-2026-61567](https://cve.now/CVE-2026-61567.md): AVideo-Encoder: unauthenticated command execution through streamer login trust (CVSS 10.0, WWBN AVideo-Encoder)
- [CVE-2026-61564](https://cve.now/CVE-2026-61564.md): AVideo-Encoder: unauthenticated installer PHP code injection (CVSS 10.0, WWBN AVideo-Encoder)
- [CVE-2026-57448](https://cve.now/CVE-2026-57448.md): Blombooru: administrator image-proxy server-side request forgery (CVSS 6.2, mrblomblo blombooru)
- [CVE-2026-93851](https://cve.now/CVE-2026-93851.md): Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post (CVSS 8.0, Mattermost)
- [CVE-2026-61546](https://cve.now/CVE-2026-61546.md): AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools (CVSS 8.8, ankimcp anki-mcp-server-addon)
- [CVE-2026-118804](https://cve.now/CVE-2026-118804.md): Bricks Broken Access Control via query\_result Endpoint (CVSS 7.5, Bricks Builder)
- [CVE-2026-118803](https://cve.now/CVE-2026-118803.md): Bricks Theme Unauthenticated Dynamic Data Tag Injection via query\_result (CVSS 7.5, Bricks Theme)
- [CVE-2026-118757](https://cve.now/CVE-2026-118757.md): PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update\_fees (CVSS 6.9, PI Websolution PiWeb Disable payment method / Partial payme…)
- [CVE-2026-118756](https://cve.now/CVE-2026-118756.md): gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir (CVSS 6.7, gopasspw gopass)
- [CVE-2026-118755](https://cve.now/CVE-2026-118755.md): Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path (CVSS 8.6, Volmarg personal-management-system)
- [CVE-2026-118754](https://cve.now/CVE-2026-118754.md): Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php (CVSS 6.9, Dolibarr ERP/CRM)
- [CVE-2026-118753](https://cve.now/CVE-2026-118753.md): FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF\_PLAYBACK Compositing (CVSS 8.5, danoli3 FreeImage · FreeImage)
- [CVE-2026-118752](https://cve.now/CVE-2026-118752.md): FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder (CVSS 8.5, danoli3 FreeImage · FreeImage)
- [CVE-2026-118694](https://cve.now/CVE-2026-118694.md): python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations (CVSS 8.7, trentm python-markdown2)
- [CVE-2026-118693](https://cve.now/CVE-2026-118693.md): CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path (CVSS 5.6, giuspen cherrytree)
- [CVE-2026-118692](https://cve.now/CVE-2026-118692.md): CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action (CVSS 7.1, giuspen cherrytree)
- [CVE-2026-118691](https://cve.now/CVE-2026-118691.md): xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message (CVSS 6.3, GuDong2003 xianyu-auto-reply-fix)
- [CVE-2026-118690](https://cve.now/CVE-2026-118690.md): Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs (CVSS 9.3, signalk-server)
- [CVE-2026-118689](https://cve.now/CVE-2026-118689.md): OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload\_length (CVSS 8.7, OvenMediaLabs OvenMediaEngine)
- [CVE-2026-118682](https://cve.now/CVE-2026-118682.md): ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM (CVSS 7.7, KaringX clashmi)
- [CVE-2026-118669](https://cve.now/CVE-2026-118669.md): OAuthLib: Token grants can use attacker-supplied client\_id for authorization after authenticating a different client (CVSS 8.4, oauthlib)
- [CVE-2026-118668](https://cve.now/CVE-2026-118668.md): LangGraph JavaScript custom authentication may permit cross-user Store access (CVSS 8.6, langchain-ai langgraph-api · langgraph-api)
- [CVE-2026-118667](https://cve.now/CVE-2026-118667.md): LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests (CVSS 4.3, langchain-ai langgraph · langchain-ai langgraph-sdk +2)
- [CVE-2026-118666](https://cve.now/CVE-2026-118666.md): GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller (CVSS 6.0, ardatan graphql-tools · @graphql-tools executor-legacy-ws +1)
- [CVE-2026-118665](https://cve.now/CVE-2026-118665.md): GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications (CVSS 8.2, ardatan graphql-tools · @graphql-tools executor-legacy-ws +1)
- [CVE-2026-118664](https://cve.now/CVE-2026-118664.md): decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs (CVSS 8.2, SamVerschueren decode-uri-component · decode-uri-component)
- [CVE-2026-118663](https://cve.now/CVE-2026-118663.md): @hono/node-server: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths (CVSS 5.3, honojs node-server · @hono/node-server)
- [CVE-2026-118662](https://cve.now/CVE-2026-118662.md): Vite: \`server.fs.deny\` bypassed with queries (CVSS 6.9, vitejs vite · vite)
- [CVE-2026-118661](https://cve.now/CVE-2026-118661.md): Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (CVSS 6.5, capricorn86 happy-dom · happy-dom)
- [CVE-2026-118660](https://cve.now/CVE-2026-118660.md): Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML (CVSS 8.6, capricorn86 happy-dom · happy-dom)
- [CVE-2026-118659](https://cve.now/CVE-2026-118659.md): @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy (CVSS 7.5, capricorn86 happy-dom)
- [CVE-2026-118658](https://cve.now/CVE-2026-118658.md): Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto (CVSS 4.7, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118657](https://cve.now/CVE-2026-118657.md): Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118656](https://cve.now/CVE-2026-118656.md): Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-76418](https://cve.now/CVE-2026-76418.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of… (CVSS 8.6, KEV, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-118655](https://cve.now/CVE-2026-118655.md): Echo: Static Middleware Double-Unescape Path Traversal (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-117574](https://cve.now/CVE-2026-117574.md): Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization (CVSS 9.1, Red Hat OpenShift AI)
- [CVE-2026-118654](https://cve.now/CVE-2026-118654.md): Echo static file middleware route protection bypass via encoded dot-dot traversal (CVSS 5.9, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-13451](https://cve.now/CVE-2026-13451.md): Kserve: kserve: server-side request forgery via malicious storageuri (CVSS 7.7, Red Hat OpenShift AI)
- [GHSA-4MFG-R38W-W8FG](https://cve.now/GHSA-4MFG-R38W-W8FG.md): mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 (high (no CVSS), mcp-sanitizer)
- [GHSA-7W82-6F9J-V9JP](https://cve.now/GHSA-7W82-6F9J-V9JP.md): mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths (high (no CVSS), mcp-sanitizer)
- [GHSA-473Q-M89C-GHF8](https://cve.now/GHSA-473Q-M89C-GHF8.md): MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificat (medium (no CVSS), MySqlConnector)
- [CVE-2026-61542](https://cve.now/CVE-2026-61542.md): Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools (CVSS 8.6, drhelius Gearboy)
- [CVE-2026-54162](https://cve.now/CVE-2026-54162.md): Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI (CVSS 4.7, alexandre-daubois ember · github.com/alexandre-daubois/ember)
- [CVE-2026-61529](https://cve.now/CVE-2026-61529.md): Endatix: Blind second-order SSRF via anonymous form-submission file URLs (\`SubmissionFileExtractor\`) (CVSS 4.7, endatix)
- [CVE-2026-118653](https://cve.now/CVE-2026-118653.md): Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118652](https://cve.now/CVE-2026-118652.md): Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVSS 6.1, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-115415](https://cve.now/CVE-2026-115415.md): Secret masking bypass in the environment tool in Strands Agents Tools (CVSS 5.9, amazon strands-agents-tools)
- [CVE-2026-118651](https://cve.now/CVE-2026-118651.md): Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-63190](https://cve.now/CVE-2026-63190.md): FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS (CVSS 9.4, fearlessgeekmedia FearlessCMS)
- [CVE-2026-118650](https://cve.now/CVE-2026-118650.md): Echo: middleware.Static: \`%2F\`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-118266](https://cve.now/CVE-2026-118266.md): Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method (CVSS 5.3, labstack echo · github.com/labstack/echo/v5 +1)
- [CVE-2026-78674](https://cve.now/CVE-2026-78674.md): Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution (CVSS 8.8, WSO2 Enterprise Integrator · WSO2 Business Process Server)
- [CVE-2026-6647](https://cve.now/CVE-2026-6647.md): Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events (CVSS 7.4, WSO2 Identity Server · WSO2 Carbon OAuth)
- [CVE-2026-3583](https://cve.now/CVE-2026-3583.md): Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products \[Disrupted Authentication Flows\] (CVSS 3.1, WSO2 API Manager · WSO2 Traffic Manager +6)
- [CVE-2026-11854](https://cve.now/CVE-2026-11854.md): Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products (CVSS 6.1, WSO2 API Manager · WSO2 API Control Plane +1)
- [CVE-2025-14260](https://cve.now/CVE-2025-14260.md): Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources (CVSS 8.3, WSO2 API Manager · WSO2 Identity Server as Key Manager +5)
- [CVE-2026-109411](https://cve.now/CVE-2026-109411.md): Samba: access control bypass via vfs\_ceph\_rgw case-insensitive open (CVSS 8.1, Samba · Red Hat Enterprise Linux +1)
- [CVE-2026-118265](https://cve.now/CVE-2026-118265.md): Echo: X-Real-IP extractor trusts the header value instead of the sending peer (CVSS 5.3, labstack echo · github.com/labstack/echo/v5)
- [CVE-2026-118264](https://cve.now/CVE-2026-118264.md): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1, labstack echo · github.com/labstack/echo/v4 +1)
- [CVE-2026-118263](https://cve.now/CVE-2026-118263.md): Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests (CVSS 6.3, labstack echo · github.com/labstack/echo/v5)
- [CVE-2026-118262](https://cve.now/CVE-2026-118262.md): Echo: WebSocket proxy can retain connections and handlers after client disconnect (CVSS 8.2, labstack echo · github.com/labstack/echo/v4 +1)
- [CVE-2026-118688](https://cve.now/CVE-2026-118688.md): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename (CVSS 8.8, bytecodealliance wasmtime)
- [CVE-2026-118687](https://cve.now/CVE-2026-118687.md): Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication (CVSS 8.3, coder)
- [CVE-2026-118686](https://cve.now/CVE-2026-118686.md): EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex (CVSS 8.7, espocrm)
- [CVE-2026-118685](https://cve.now/CVE-2026-118685.md): ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard (CVSS 6.9, ToolJet)
- [CVE-2026-118684](https://cve.now/CVE-2026-118684.md): MONAI before 1.6.1 Missing Integrity Verification via check\_hash in Downloads (CVSS 8.2, Project-MONAI MONAI)
- [CVE-2026-118683](https://cve.now/CVE-2026-118683.md): MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf (CVSS 8.6, Project-MONAI MONAI)
- [CVE-2026-118681](https://cve.now/CVE-2026-118681.md): go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware (CVSS 6.3, go-chi chi)
- [CVE-2026-118680](https://cve.now/CVE-2026-118680.md): SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias (CVSS 5.9, siyuan-note siyuan)
- [CVE-2026-118679](https://cve.now/CVE-2026-118679.md): n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger (CVSS 6.9, n8n-io n8n)
- [CVE-2026-118678](https://cve.now/CVE-2026-118678.md): n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction (CVSS 7.1, n8n-io n8n)
- [CVE-2026-118677](https://cve.now/CVE-2026-118677.md): n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance (CVSS 5.9, n8n-io n8n)
- [CVE-2026-118676](https://cve.now/CVE-2026-118676.md): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass (CVSS 5.1, n8n-io n8n)
- [CVE-2026-118675](https://cve.now/CVE-2026-118675.md): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow (CVSS 5.1, n8n-io n8n)
- [CVE-2026-118649](https://cve.now/CVE-2026-118649.md): n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables (CVSS 8.7, n8n-io n8n)
- [CVE-2026-118648](https://cve.now/CVE-2026-118648.md): n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy (CVSS 8.4, n8n-io n8n)
- [CVE-2026-118647](https://cve.now/CVE-2026-118647.md): n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data (CVSS 5.3, n8n-io n8n)
- [CVE-2026-118646](https://cve.now/CVE-2026-118646.md): n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node (CVSS 7.1, n8n-io n8n)
- [CVE-2026-118645](https://cve.now/CVE-2026-118645.md): n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter (CVSS 7.0, n8n-io n8n)
- [CVE-2026-118644](https://cve.now/CVE-2026-118644.md): n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance (CVSS 5.1, n8n-io n8n)
- [CVE-2026-118643](https://cve.now/CVE-2026-118643.md): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data (CVSS 5.3, n8n-io n8n)
- [CVE-2026-118642](https://cve.now/CVE-2026-118642.md): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows (CVSS 5.1, n8n-io n8n)
- [CVE-2026-118641](https://cve.now/CVE-2026-118641.md): n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes (CVSS 6.9, n8n-io n8n)
- [CVE-2026-118640](https://cve.now/CVE-2026-118640.md): n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass (CVSS 5.3, n8n-io n8n)
- [CVE-2026-118261](https://cve.now/CVE-2026-118261.md): Echo: Decompress permits unbounded gzip expansion in v4 (CVSS 8.2, labstack echo · github.com/labstack/echo/v4)
- [CVE-2026-118260](https://cve.now/CVE-2026-118260.md): Echo: BodyDump captures request and response bodies without size limits in v4 (CVSS 8.2, labstack echo · github.com/labstack/echo/v4)
- [CVE-2026-118259](https://cve.now/CVE-2026-118259.md): opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing (CVSS 5.3, open-telemetry opentelemetry-java · io.opentelemetry:opente…)
- [CVE-2026-118633](https://cve.now/CVE-2026-118633.md): A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after (CVSS 8.1, Sophos SG UTM)
- [CVE-2026-118258](https://cve.now/CVE-2026-118258.md): i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string (CVSS 3.7, i18next-http-backend)
- [CVE-2026-118257](https://cve.now/CVE-2026-118257.md): Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages (CVSS 7.2, intlify vue-i18n · vue-i18n +5)
- [CVE-2026-118256](https://cve.now/CVE-2026-118256.md): Vue I18n: \`escapeParameter\` does not escape named values when the same call also passes a list (CVSS 2.1, intlify vue-i18n · vue-i18n +4)
- [CVE-2026-118255](https://cve.now/CVE-2026-118255.md): Highcharts Grid: javascript: URL in credits.href runs script on click (CVSS 8.4, highcharts · @highcharts dashboards +3)
- [CVE-2026-118254](https://cve.now/CVE-2026-118254.md): Highcharts Grid: pagination language options are parsed as HTML (CVSS 8.6, highcharts · @highcharts grid-lite +3)
- [CVE-2026-118253](https://cve.now/CVE-2026-118253.md): Highcharts Dashboards: fullscreen labels are parsed as HTML (CVSS 8.4, highcharts · @highcharts dashboards +1)
- [CVE-2026-118252](https://cve.now/CVE-2026-118252.md): Highcharts Dashboards: sidebar component labels are parsed as HTML (CVSS 8.4, highcharts · @highcharts dashboards +1)
- [CVE-2026-106484](https://cve.now/CVE-2026-106484.md): Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrar (CVSS 4.4, Google chrome-devtools-mcp)
- [CVE-2026-118251](https://cve.now/CVE-2026-118251.md): Highcharts: javascript: URL in credits.href runs script on click (CVSS 8.4, highcharts)
- [CVE-2026-118250](https://cve.now/CVE-2026-118250.md): Highcharts: dotted series.keys paths write to Object.prototype (CVSS 7.2, highcharts)
- [CVE-2026-118249](https://cve.now/CVE-2026-118249.md): Highcharts: series column construction writes to Object.prototype (CVSS 7.2, highcharts)
- [CVE-2026-118248](https://cve.now/CVE-2026-118248.md): Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype (CVSS 6.9, highcharts · @highcharts dashboards)
- [CVE-2026-118247](https://cve.now/CVE-2026-118247.md): Highcharts Dashboards / Grid Pro: \`DataTable.setCell\` and column writers treat \`\_\_proto\_\_\` as an existing column. (CVSS 6.9, highcharts · @highcharts dashboards +3)
- [CVE-2026-118246](https://cve.now/CVE-2026-118246.md): Highcharts Core: \`breadcrumbs.style\` keys become SVG event-handler attributes (CVSS 8.4, highcharts)
- [CVE-2026-118245](https://cve.now/CVE-2026-118245.md): Highcharts Dashboards: \`chartConstructor\` is an unchecked lookup into the Highcharts namespace (CVSS 8.6, highcharts · @highcharts dashboards +1)
- [CVE-2026-118244](https://cve.now/CVE-2026-118244.md): Highcharts Core: AST \`DOMParser\` fallback assigns unsanitized markup to \`innerHTML\` during print (CVSS 7.2, highcharts)
- [CVE-2026-116273](https://cve.now/CVE-2026-116273.md): MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion (no CVSS, MIME-tools)
- [CVE-2026-116272](https://cve.now/CVE-2026-116272.md): MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment (no CVSS, MIME-tools)
- [CVE-2026-116271](https://cve.now/CVE-2026-116271.md): MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes (no CVSS, MIME-tools)
- [CVE-2026-116270](https://cve.now/CVE-2026-116270.md): MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode\_mimewords (no CVSS, MIME-tools)
- [CVE-2026-118243](https://cve.now/CVE-2026-118243.md): Highcharts Dashboards: \`\_\_proto\_\_\` data table id writes sync listeners to \`Object.prototype\` (CVSS 5.3, highcharts · @highcharts/dashboards)
- [CVE-2026-116269](https://cve.now/CVE-2026-116269.md): MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename (no CVSS, MIME-tools)
- [CVE-2026-116268](https://cve.now/CVE-2026-116268.md): MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters (no CVSS, MIME-tools)
- [CVE-2026-116267](https://cve.now/CVE-2026-116267.md): MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message (no CVSS, MIME-tools)
- [CVE-2026-116266](https://cve.now/CVE-2026-116266.md): MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous (no CVSS, MIME-tools)
- [CVE-2026-116265](https://cve.now/CVE-2026-116265.md): MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations (no CVSS, MIME-tools)
- [CVE-2026-110183](https://cve.now/CVE-2026-110183.md): PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-110182](https://cve.now/CVE-2026-110182.md): PostgreSQL Anonymizer: anon.partial() and anon.partial\_email() can reveal the whole data (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-110181](https://cve.now/CVE-2026-110181.md): PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data (CVSS 6.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-116264](https://cve.now/CVE-2026-116264.md): MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary (no CVSS, MIME-tools)
- [CVE-2026-105620](https://cve.now/CVE-2026-105620.md): PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query (CVSS 6.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105619](https://cve.now/CVE-2026-105619.md): PostgreSQL Anonymizer: Masking rules of the tables are not applied through security\_invoker views (CVSS 4.8, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105618](https://cve.now/CVE-2026-105618.md): PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent (CVSS 5.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105617](https://cve.now/CVE-2026-105617.md): PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule (CVSS 5.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105616](https://cve.now/CVE-2026-105616.md): PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg\_roles or pg\_db\_role\_setting (CVSS 5.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105615](https://cve.now/CVE-2026-105615.md): PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg\_stats (CVSS 3.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105614](https://cve.now/CVE-2026-105614.md): PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image\_blur() (CVSS 4.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105613](https://cve.now/CVE-2026-105613.md): PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions (CVSS 4.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105612](https://cve.now/CVE-2026-105612.md): PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles (CVSS 3.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-118242](https://cve.now/CVE-2026-118242.md): Highcharts Grid: custom icon definition objects written with raw \`setAttribute\` on \`\<path\>\` (CVSS 8.5, highcharts · @highcharts grid-lite +3)
- [CVE-2026-84725](https://cve.now/CVE-2026-84725.md): Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap (CVSS 8.1, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-116797](https://cve.now/CVE-2026-116797.md): Highcharts Grid Pro: cell-renderer \`attributes\` map written with raw \`setAttribute\` (CVSS 8.5, highcharts · @highcharts grid-pro +3)
- [CVE-2026-79656](https://cve.now/CVE-2026-79656.md): OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors (CVSS 6.0, Grafana OSS · Grafana Enterprise)
- [CVE-2026-116796](https://cve.now/CVE-2026-116796.md): Highcharts Core: \`javascript:\` URL in an \`xlink:href\` attribute survives text filtering and reaches exported charts (CVSS 7.2, highcharts)
- [CVE-2026-58458](https://cve.now/CVE-2026-58458.md): Don't Starve Together Memory Corruption via world\_gen\_data (CVSS 6.9, Klei Entertainment Don't Starve Together)
- [CVE-2026-117501](https://cve.now/CVE-2026-117501.md): HTTP::Body versions before 1.24\_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies (no CVSS, HTTP-Body)
- [CVE-2026-117500](https://cve.now/CVE-2026-117500.md): HTTP::Body versions before 1.24\_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload (no CVSS, HTTP-Body)
- [CVE-2026-116531](https://cve.now/CVE-2026-116531.md): HTTP::Body versions before 1.23\_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk (no CVSS, HTTP-Body)
- [CVE-2026-116285](https://cve.now/CVE-2026-116285.md): HTTP::Body versions before 1.23\_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies (no CVSS, HTTP-Body)
- [CVE-2026-116135](https://cve.now/CVE-2026-116135.md): HTTP::Body versions before 1.23\_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them (no CVSS, HTTP-Body)
- [CVE-2026-116134](https://cve.now/CVE-2026-116134.md): HTTP::Body versions before 1.23\_01 for Perl allow memory exhaustion via an unbounded multipart part header block (no CVSS, HTTP-Body)
- [CVE-2026-116133](https://cve.now/CVE-2026-116133.md): HTTP::Body versions before 1.23\_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary (no CVSS, HTTP-Body)
- [CVE-2026-116132](https://cve.now/CVE-2026-116132.md): HTTP::Body versions before 1.23\_01 for Perl leave the temporary file of an incomplete multipart upload on disk (no CVSS, HTTP-Body)
- [CVE-2026-116131](https://cve.now/CVE-2026-116131.md): HTTP::Body versions before 1.23\_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts (no CVSS, HTTP-Body)
- [CVE-2026-116795](https://cve.now/CVE-2026-116795.md): RE2JS: Quadratic-time denial of service in re2js lookbehind matching (CVSS 7.5, le0pard re2js · re2js)
- [CVE-2026-116794](https://cve.now/CVE-2026-116794.md): russh: Agent server never calls \`Agent::confirm\`, so keys added with the confirm constraint (\`ssh-add -c\`) sign without confirmation (CVSS 8.3, Eugeny russh · russh)
- [CVE-2026-82962](https://cve.now/CVE-2026-82962.md): Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-82961](https://cve.now/CVE-2026-82961.md): Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-118619](https://cve.now/CVE-2026-118619.md): Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability (CVSS 8.8, Ultralytics)
- [CVE-2026-118618](https://cve.now/CVE-2026-118618.md): Ultralytics parse\_model Code Injection Remote Code Execution Vulnerability (CVSS 7.8, Ultralytics)
- [CVE-2026-118617](https://cve.now/CVE-2026-118617.md): Ultralytics load\_dataset\_cache\_file Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Ultralytics)
- [CVE-2026-118616](https://cve.now/CVE-2026-118616.md): Ultralytics parse\_model Code Injection Remote Code Execution Vulnerability (CVSS 7.8, Ultralytics)
- [CVE-2026-118615](https://cve.now/CVE-2026-118615.md): Ultralytics torch\_safe\_load Command Injection Remote Code Execution Vulnerability (CVSS 7.8, Ultralytics)
- [CVE-2026-118614](https://cve.now/CVE-2026-118614.md): Ultralytics check\_det\_dataset Code Injection Remote Code Execution Vulnerability (CVSS 7.8, Ultralytics)
- [CVE-2026-118613](https://cve.now/CVE-2026-118613.md): Ultralytics torch\_load Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Ultralytics)
- [CVE-2026-118581](https://cve.now/CVE-2026-118581.md): NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol (CVSS 6.9, MongoDB Java Driver)
- [CVE-2026-118611](https://cve.now/CVE-2026-118611.md): Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8, Alpine iLX-F511)
- [CVE-2026-118610](https://cve.now/CVE-2026-118610.md): Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Alpine iLX-F511)
- [CVE-2026-118609](https://cve.now/CVE-2026-118609.md): Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8, Alpine iLX-F511)
- [CVE-2026-118608](https://cve.now/CVE-2026-118608.md): Alpine iLX-F511 libanwbtstack.so prh\_rfcomm\_cc\_process\_test Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.5, Alpine iLX-F511)
- [CVE-2026-118607](https://cve.now/CVE-2026-118607.md): Alpine iLX-F511 diagapp Command Injection Vulnerability (CVSS 6.8, Alpine iLX-F511)
- [CVE-2026-103506](https://cve.now/CVE-2026-103506.md): SSO settings authorization bypass (CVSS 8.9, Grafana Enterprise · Grafana OSS)
- [CVE-2026-118606](https://cve.now/CVE-2026-118606.md): Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability (CVSS 8.8, Alpine iLX-F511)
- [CVE-2026-118605](https://cve.now/CVE-2026-118605.md): Alpine iLX-F511 prh\_sdp\_service\_search\_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Alpine iLX-F511)
- [CVE-2026-88858](https://cve.now/CVE-2026-88858.md): Server-side expression parser denial of service (CVSS 6.5, Grafana OSS · Grafana Enterprise)
- [CVE-2026-118604](https://cve.now/CVE-2026-118604.md): Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8, Alpine iLX-F511)
- [CVE-2026-118603](https://cve.now/CVE-2026-118603.md): Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.0, Alpine iLX-F511)
- [CVE-2026-118602](https://cve.now/CVE-2026-118602.md): Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability (CVSS 7.8, Alpine iLX-F511)
- [CVE-2026-118601](https://cve.now/CVE-2026-118601.md): Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability (CVSS 6.3, Alpine iLX-F511)
- [CVE-2026-88967](https://cve.now/CVE-2026-88967.md): Azure Monitor access token disclosure via SSRF (CVSS 7.7, Grafana Enterprise · Grafana OSS)
- [CVE-2026-100105](https://cve.now/CVE-2026-100105.md): Alerting contact point authorization bypass via schema downgrade (CVSS 7.7, Grafana Enterprise · Grafana OSS)
- [CVE-2026-117626](https://cve.now/CVE-2026-117626.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for worksp (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117625](https://cve.now/CVE-2026-117625.md): A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117624](https://cve.now/CVE-2026-117624.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117623](https://cve.now/CVE-2026-117623.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, r (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117622](https://cve.now/CVE-2026-117622.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the c (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117621](https://cve.now/CVE-2026-117621.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file an (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117620](https://cve.now/CVE-2026-117620.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117619](https://cve.now/CVE-2026-117619.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117618](https://cve.now/CVE-2026-117618.md): In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117617](https://cve.now/CVE-2026-117617.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its paren (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117616](https://cve.now/CVE-2026-117616.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117615](https://cve.now/CVE-2026-117615.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing atta (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117614](https://cve.now/CVE-2026-117614.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117613](https://cve.now/CVE-2026-117613.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers wit (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-117612](https://cve.now/CVE-2026-117612.md): Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the \`resolves-to\` attr (no CVSS, Jenkins Project Jenkins)
- [CVE-2026-114349](https://cve.now/CVE-2026-114349.md): Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-112375](https://cve.now/CVE-2026-112375.md): Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-116593](https://cve.now/CVE-2026-116593.md): Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-115644](https://cve.now/CVE-2026-115644.md): Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions (low (no CVSS), Apache Software Foundation Apache Kafka)
- [CVE-2026-111551](https://cve.now/CVE-2026-111551.md): Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-111496](https://cve.now/CVE-2026-111496.md): Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation (low (no CVSS), Apache Software Foundation Apache Kafka)
- [CVE-2026-111115](https://cve.now/CVE-2026-111115.md): Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-111108](https://cve.now/CVE-2026-111108.md): Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-111073](https://cve.now/CVE-2026-111073.md): Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-106079](https://cve.now/CVE-2026-106079.md): Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration (CVSS 8.8, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-110985](https://cve.now/CVE-2026-110985.md): Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-103411](https://cve.now/CVE-2026-103411.md): Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing (CVSS 7.1, Juniper Networks Session Smart Router)
- [CVE-2026-110952](https://cve.now/CVE-2026-110952.md): Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default (no CVSS, Apache Software Foundation Apache Kafka)
- [CVE-2026-83525](https://cve.now/CVE-2026-83525.md): Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request. (low (no CVSS), Apache Software Foundation Apache Kafka)
- [CVE-2026-103410](https://cve.now/CVE-2026-103410.md): Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection (CVSS 7.5, Juniper Networks Session Smart Router)
- [CVE-2026-103409](https://cve.now/CVE-2026-103409.md): Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed (CVSS 9.8, Juniper Networks Session Smart Router)
- [CVE-2026-103408](https://cve.now/CVE-2026-103408.md): Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options (CVSS 8.8, Juniper Networks Session Smart Router)
- [CVE-2026-103407](https://cve.now/CVE-2026-103407.md): Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management (CVSS 8.8, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-103406](https://cve.now/CVE-2026-103406.md): Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. (CVSS 9.8, Juniper Networks Session Smart Conductor)
- [CVE-2026-103405](https://cve.now/CVE-2026-103405.md): Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting (CVSS 5.8, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-103404](https://cve.now/CVE-2026-103404.md): Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials (CVSS 6.8, Juniper Networks Session Smart Conductor)
- [CVE-2026-103403](https://cve.now/CVE-2026-103403.md): Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules (CVSS 8.8, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-103402](https://cve.now/CVE-2026-103402.md): Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation (CVSS 8.8, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-103401](https://cve.now/CVE-2026-103401.md): Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root (CVSS 8.8, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-103400](https://cve.now/CVE-2026-103400.md): Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup (CVSS 5.5, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-103394](https://cve.now/CVE-2026-103394.md): Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates. (CVSS 3.7, Juniper Networks Session Smart Router)
- [CVE-2026-103393](https://cve.now/CVE-2026-103393.md): Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing (CVSS 4.3, Juniper Networks Session Smart Router)
- [CVE-2026-103392](https://cve.now/CVE-2026-103392.md): Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled (CVSS 4.8, Juniper Networks Session Smart Router)
- [CVE-2026-93536](https://cve.now/CVE-2026-93536.md): X.Org Server GestureBuildSprite Use-After-Free (CVSS 5.3, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-103391](https://cve.now/CVE-2026-103391.md): Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature (CVSS 5.3, Juniper Networks Session Smart Router)
- [CVE-2026-103390](https://cve.now/CVE-2026-103390.md): Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification (CVSS 5.3, Juniper Networks Session Smart Router · Juniper Networks Se…)
- [CVE-2026-93524](https://cve.now/CVE-2026-93524.md): X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (CVSS 6.9, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-93523](https://cve.now/CVE-2026-93523.md): X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write (CVSS 7.8, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-118510](https://cve.now/CVE-2026-118510.md): Laravel MongoDB \`whereDoesntHave\` misses deny records for numeric string IDs (CVSS 7.7, Laravel MongoDB)
- [CVE-2026-93522](https://cve.now/CVE-2026-93522.md): X.Org Server Glamor CopyArea Heap Buffer Overflow (CVSS 7.8, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-116778](https://cve.now/CVE-2026-116778.md): FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution (CVSS 8.8, fogproject)
- [CVE-2026-116776](https://cve.now/CVE-2026-116776.md): USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK\_GEOMETRY.BytesPerSector leads to RCE/DoS (CVSS 7.0, n-romanovich usb-test)
- [CVE-2026-56828](https://cve.now/CVE-2026-56828.md): Shopper: read-only team permissions allow administrator creation and permission escalation (CVSS 8.8, shopperlabs shopper)
- [CVE-2026-47235](https://cve.now/CVE-2026-47235.md): SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem\_id Array (CVSS 7.5, simulationcraft simc)
- [CVE-2026-93521](https://cve.now/CVE-2026-93521.md): X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow (CVSS 7.8, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-59979](https://cve.now/CVE-2026-59979.md): YosemiteCrew: Missing organization authorization on service and PMS library/template routes (CVSS 8.3, YosemiteCrew Yosemite-Crew)
- [CVE-2026-44179](https://cve.now/CVE-2026-44179.md): XWiki Pro Macros: excerpt-include title and content injection executes code (CVSS 9.9, xwikisas xwiki-pro-macros · com.xwiki.pro:xwiki-pro-macros)
- [CVE-2026-50542](https://cve.now/CVE-2026-50542.md): Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure (CVSS 5.4, xibosignage xibo-cms)
- [CVE-2026-118029](https://cve.now/CVE-2026-118029.md): Unverified ownership of the default Athena query result location in AWS SDK for pandas (CVSS 5.9, aws-sdk-pandas)
- [CVE-2026-50543](https://cve.now/CVE-2026-50543.md): Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices (CVSS 4.3, xibosignage xibo-cms)
- [CVE-2026-112357](https://cve.now/CVE-2026-112357.md): GFI KerioConnect KOFF \< 10.0.9p2 Privilege Escalation (CVSS 8.5, GFI USA GFI KerioConnect)
- [CVE-2026-50539](https://cve.now/CVE-2026-50539.md): Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments (CVSS 6.5, xibosignage xibo-cms)
- [CVE-2026-112356](https://cve.now/CVE-2026-112356.md): GFI KerioConnect \< 10.0.9p2 XSS via Link Auto-Formatter (CVSS 5.1, GFI USA GFI KerioConnect)
- [CVE-2026-67187](https://cve.now/CVE-2026-67187.md): Ninja Forms WordPress Plugin \< 3.15.4 Server-Side Validation Bypass via List Fields (CVSS 5.1, Saturday Drive Ninja Forms)
- [CVE-2026-115402](https://cve.now/CVE-2026-115402.md): OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition i (CVSS 5.7, OpenVPN ovpn-dco-win)
- [CVE-2026-93520](https://cve.now/CVE-2026-93520.md): X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write (CVSS 7.8, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-93519](https://cve.now/CVE-2026-93519.md): X.Org Server XFixes Pointer Barrier Event List Buffer Overflow (CVSS 7.8, x.org xorg-x11-server · x.orgg xwayland)
- [CVE-2026-93518](https://cve.now/CVE-2026-93518.md): X.Org Server XKB ResizeKeyType Numeric Truncation (CVSS 7.8, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-115603](https://cve.now/CVE-2026-115603.md): WordPress Advanced Ads – Tracking plugin \< 4.0.0 - SQL Injection vulnerability (CVSS 8.5, Advanced Ads – Tracking)
- [CVE-2026-115968](https://cve.now/CVE-2026-115968.md): WordPress Ultimate Member plugin \<= 2.13.1 - PHP Object Injection vulnerability (CVSS 9.8, Ultimate Member)
- [CVE-2026-116390](https://cve.now/CVE-2026-116390.md): WordPress Filter Everything — WordPress & WooCommerce Filters plugin \<= 1.9.7 - PHP Object Injection vulnerability (CVSS 7.2, stepasyuk Filter Everything&nbsp;— WordPress &amp; WooComme…)
- [CVE-2026-116389](https://cve.now/CVE-2026-116389.md): WordPress Phoenix Media Rename plugin \<= 3.13.5 - PHP Object Injection vulnerability (CVSS 8.8, crossi72 Phoenix Media Rename)
- [CVE-2026-115590](https://cve.now/CVE-2026-115590.md): WordPress Dokan plugin \<= 5.3.1 - PHP Object Injection vulnerability (CVSS 7.2, weDevs Dokan)
- [CVE-2026-116078](https://cve.now/CVE-2026-116078.md): HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit (CVSS 8.7, mtrudel bandit)
- [CVE-2026-50541](https://cve.now/CVE-2026-50541.md): Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export (CVSS 6.5, xibosignage xibo-cms)
- [CVE-2026-52729](https://cve.now/CVE-2026-52729.md): Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion (CVSS 7.1, xibosignage xibo-cms)
- [CVE-2026-105420](https://cve.now/CVE-2026-105420.md): Path Traversal in Wing WFTP Server leading to Remote Code Execution (CVSS 9.4, Wing Soft Technology Wing FTP Server)
- [CVE-2026-59959](https://cve.now/CVE-2026-59959.md): SAIL: WebP decoder division by zero through malformed animated canvas metadata (CVSS 4.8, HappySeaFox sail)
- [CVE-2026-93517](https://cve.now/CVE-2026-93517.md): X.Org Server GLX RenderLarge Heap Buffer Overflow (CVSS 8.5, x.orgg xorg-x11-server · x.org xwayland)
- [CVE-2026-59185](https://cve.now/CVE-2026-59185.md): identrail: Cross-tenant GitHub installation binding without ownership verification (CVSS 8.5, identrail)
- [CVE-2026-59179](https://cve.now/CVE-2026-59179.md): OpenHop: Path Traversal in Flow ID File Operations (CVSS 8.3, naorsabag openhop · @openhop/server)
- [CVE-2026-59177](https://cve.now/CVE-2026-59177.md): ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces (CVSS 8.8, esphome device-builder)
- [CVE-2026-59176](https://cve.now/CVE-2026-59176.md): Functype: MCP set\_functype\_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import (CVSS 7.8, jordanburke functype)
- [CVE-2026-59172](https://cve.now/CVE-2026-59172.md): Joker linter executed project-local .jokerd/linter.\* files during linting (CVSS 7.8, candid82 joker)
- [CVE-2026-59164](https://cve.now/CVE-2026-59164.md): NORA missing cross-user token-management authorization (CVSS 7.1, getnora-io nora)
- [CVE-2026-93516](https://cve.now/CVE-2026-93516.md): .Org Server XInput Passive Grab Use-After-Free (CVSS 5.5, x.org xorg-x11-server · x.org xwayland)
- [CVE-2026-116391](https://cve.now/CVE-2026-116391.md): WordPress GS Logo Slider plugin \<= 3.8.9 - PHP Object Injection vulnerability (CVSS 8.8, GS Plugins GS Logo Slider)
- [CVE-2026-116392](https://cve.now/CVE-2026-116392.md): WordPress Accordion plugin \<= 2.3.25 - PHP Object Injection vulnerability (CVSS 7.2, PickPlugins Accordion)
- [CVE-2026-116393](https://cve.now/CVE-2026-116393.md): WordPress Optima Express + MarketBoost IDX Plugin plugin \<= 8.7.8 - Broken Access Control vulnerability (CVSS 7.5, iHomefinder Optima Express)
- [CVE-2026-116404](https://cve.now/CVE-2026-116404.md): WordPress Redux Framework plugin \<= 4.5.16 - Broken Access Control vulnerability (CVSS 6.5, David Anderson Redux Framework)
- [CVE-2026-111850](https://cve.now/CVE-2026-111850.md): WordPress BuddyPress plugin \<= 14.5.2 - SQL Injection vulnerability (CVSS 8.5, BuddyPress)
- [CVE-2026-115612](https://cve.now/CVE-2026-115612.md): WordPress SliceWP plugin \<= 1.2.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, iova.mihai SliceWP)
- [CVE-2026-115591](https://cve.now/CVE-2026-115591.md): WordPress Contact Form by Supsystic plugin \<= 1.10.5 - Sensitive Data Exposure vulnerability (CVSS 7.5, Contact Form by Supsystic)
- [CVE-2026-115593](https://cve.now/CVE-2026-115593.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.24 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unlimited Elements For Elementor)
- [CVE-2026-115596](https://cve.now/CVE-2026-115596.md): WordPress eCommerce Product Catalog plugin \<= 3.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, impleCode eCommerce Product Catalog)
- [CVE-2026-111411](https://cve.now/CVE-2026-111411.md): WordPress FunnelKit Automations plugin \<= 3.8.5.2 - SQL Injection vulnerability (CVSS 9.3, Aman FunnelKit Automations)
- [CVE-2026-115607](https://cve.now/CVE-2026-115607.md): WordPress DXP ToolKit plugin \<= 2.0.1 - SQL Injection vulnerability (CVSS 9.3, Crowd Favorite DXP ToolKit)
- [CVE-2026-115957](https://cve.now/CVE-2026-115957.md): WordPress WP Discussion Board plugin \<= 2.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Discussion Board)
- [CVE-2026-115606](https://cve.now/CVE-2026-115606.md): WordPress DXP ToolKit plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crowd Favorite DXP ToolKit)
- [CVE-2026-115609](https://cve.now/CVE-2026-115609.md): WordPress GetPaid plugin \<= 2.8.62 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stiofan GetPaid)
- [CVE-2026-55369](https://cve.now/CVE-2026-55369.md): Waline login accepts a non-string email as a match-all MongoDB query (CVSS 6.5, walinejs waline · @waline/vercel)
- [CVE-2026-115904](https://cve.now/CVE-2026-115904.md): Topluyo Desktop for Linux has an OS Command Injection issue (CVSS 9.6, topluyo App)
- [CVE-2026-93515](https://cve.now/CVE-2026-93515.md): .Org Server Present Extension Use-After-Free (CVSS 6.8, X.org xorg-x11-server · x.org xwayland)
- [CVE-2026-21830](https://cve.now/CVE-2026-21830.md): HCL BigFix AEX is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software BigFix AEX)
- [CVE-2026-118037](https://cve.now/CVE-2026-118037.md): Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing (CVSS 7.5, Progress Software Telerik Document Processing Libraries)
- [CVE-2026-118036](https://cve.now/CVE-2026-118036.md): Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering (CVSS 7.5, Progress Software Telerik Document Processing Libraries)
- [CVE-2026-118035](https://cve.now/CVE-2026-118035.md): Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing (CVSS 7.5, Progress Software Telerik Document Processing Libraries)
- [CVE-2026-118040](https://cve.now/CVE-2026-118040.md): Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing (CVSS 7.5, Progress Software Telerik Document Processing Libraries)
- [CVE-2026-118039](https://cve.now/CVE-2026-118039.md): XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing (CVSS 7.5, Progress Software Telerik Document Processing Libraries)
- [CVE-2026-118038](https://cve.now/CVE-2026-118038.md): Path Traversal in Telerik Document Processing Libraries AI Agent Tools (CVSS 7.1, Progress Software Telerik Document Processing Libraries)
- [CVE-2026-67077](https://cve.now/CVE-2026-67077.md): HCL BigFix AEX is affected by multiple security vulnerabilities. (CVSS 4.2, HCL Software BigFix AEX)
- [CVE-2026-67079](https://cve.now/CVE-2026-67079.md): HCL BigFix AEX is affected by multiple security vulnerabilities. (CVSS 6.4, HCL Software BigFix AEX)
- [CVE-2026-67080](https://cve.now/CVE-2026-67080.md): HCL BigFix AEX is affected by multiple security vulnerabilities. (CVSS 6.5, HCL Software BigFix AEX)
- [CVE-2026-67073](https://cve.now/CVE-2026-67073.md): HCL BigFix AEX is affected by multiple security vulnerabilities. (CVSS 8.6, HCL Software BigFix AEX)
- [CVE-2026-67074](https://cve.now/CVE-2026-67074.md): HCL BigFix AEX is affected by multiple security vulnerabilities. (CVSS 9.1, HCL Software BigFix AEX)
- [RUSTSEC-2026-0415](https://cve.now/RUSTSEC-2026-0415.md): Unbounded memory use on large request bodies (no CVSS, juniper\_hyper)
- [RUSTSEC-2026-0416](https://cve.now/RUSTSEC-2026-0416.md): Stack overflow on deeply nested GraphQL documents (no CVSS, juniper)
- [RUSTSEC-2026-0417](https://cve.now/RUSTSEC-2026-0417.md): Excessive CPU and memory use on crafted GraphQL documents (no CVSS, juniper)
- [RUSTSEC-2026-0418](https://cve.now/RUSTSEC-2026-0418.md): libz-sys build script leaks environment variables in the build directory (no CVSS, libz-sys)
- [CVE-2026-102790](https://cve.now/CVE-2026-102790.md): Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 (CVSS 8.6, icagenda.com iCagenda extension for Joomla)
- [CVE-2026-81472](https://cve.now/CVE-2026-81472.md): Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versio (CVSS 4.2, Dell iDRAC Service Module for Windows · Dell iDRAC Servi… +1)
- [CVE-2026-114278](https://cve.now/CVE-2026-114278.md): Unauthenticated Command Injection via kubeconfig Username in che-machine-exec (CVSS 9.8, Eclipse Foundation Eclipse Che)
- [CVE-2026-102799](https://cve.now/CVE-2026-102799.md): Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 (CVSS 5.3, icagenda.com iCagenda extension for Joomla)
- [CVE-2026-118485](https://cve.now/CVE-2026-118485.md): Axel Download Accelerator Path Traversal via URL Filename Decoding (CVSS 7.0, Axel Download Accelerator Axel)
- [CVE-2026-116855](https://cve.now/CVE-2026-116855.md): WordPress My auctions allegro plugin \<= 4.0.3 - Broken Access Control vulnerability (CVSS 5.4, wphocus My auctions allegro)
- [CVE-2026-118477](https://cve.now/CVE-2026-118477.md): KaliFast Project Management Platform ei\_git\_repo\_url OS Command Injection (CVSS 8.7, EISGE Kalifast)
- [CVE-2026-6064](https://cve.now/CVE-2026-6064.md): Norton, Avast, and AVG local privilege escalation via link following in Data Shredder (CVSS 7.3, Gen Digital Norton Antivirus · Gen Digital Avast Antivir… +1)
- [CVE-2026-115223](https://cve.now/CVE-2026-115223.md): Smart Popup by Supsystic \< 2.0.2 - Admin+ SSTI via Popup Text Block (CVSS 4.9, Smart Popup by Supsystic)
- [CVE-2026-110508](https://cve.now/CVE-2026-110508.md): Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification (CVSS 5.3, Essential Addons for Elementor)
- [CVE-2026-106648](https://cve.now/CVE-2026-106648.md): Royal Elementor Addons \< 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes (CVSS 5.3, Royal Elementor Addons)
- [CVE-2026-103330](https://cve.now/CVE-2026-103330.md): Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass (CVSS 5.3, Sadad QA Payment)
- [CVE-2026-103313](https://cve.now/CVE-2026-103313.md): BitPay Gateway for WooCommerce \<= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler (CVSS 5.3, BitPay Gateway for WooCommerce)
- [CVE-2026-99216](https://cve.now/CVE-2026-99216.md): Drivers: hv: Don't reset VMBus connection state on error/exit paths (CVSS 8.4, Linux)
- [CVE-2026-99215](https://cve.now/CVE-2026-99215.md): power: supply: core: prevent unregistering a power supply while a callback runs (no CVSS, Linux)
- [CVE-2026-99214](https://cve.now/CVE-2026-99214.md): drm/vc4: hdmi: Move packet RAM enable to PM runtime (no CVSS, Linux)
- [CVE-2026-99213](https://cve.now/CVE-2026-99213.md): vsock: treat TCP\_CLOSING as once-established (CVSS 7.8, Linux)
- [CVE-2026-99212](https://cve.now/CVE-2026-99212.md): net/rds: don't let the rdma\_cm destroy an id RDS still owns on route failure (CVSS 7.0, Linux)
- [CVE-2026-99211](https://cve.now/CVE-2026-99211.md): netlink: reset skb headers before unicast and multicast filtering (no CVSS, Linux)
- [CVE-2026-99210](https://cve.now/CVE-2026-99210.md): accel/rocket: clear rdev on device init failure (no CVSS, Linux)
- [CVE-2026-99209](https://cve.now/CVE-2026-99209.md): drm/xe: skip eviction of a BO with no resource (no CVSS, Linux)
- [CVE-2026-99208](https://cve.now/CVE-2026-99208.md): drm/xe/oa: Zero OA buffer at allocation (no CVSS, Linux)
- [CVE-2026-99207](https://cve.now/CVE-2026-99207.md): scsi: target: Disable interrupts while holding delayed\_cmd\_lock (no CVSS, Linux)
- [CVE-2026-99206](https://cve.now/CVE-2026-99206.md): scsi: target: iscsi: Fix race in discovery auth updates (no CVSS, Linux)
- [CVE-2026-99205](https://cve.now/CVE-2026-99205.md): sched/core: Call wakeup\_preempt() for queued tasks during class change (no CVSS, Linux)
- [CVE-2026-99204](https://cve.now/CVE-2026-99204.md): ocfs2/dlm: Protect the recovery list during debugfs reads (no CVSS, Linux)
- [CVE-2026-99203](https://cve.now/CVE-2026-99203.md): pipe: preserve existing fasync readers on writer setup failure (CVSS 7.8, Linux)
- [CVE-2026-99202](https://cve.now/CVE-2026-99202.md): scsi: libsas: Fix SMP IO deadlock during HA resume (no CVSS, Linux)
- [CVE-2026-99201](https://cve.now/CVE-2026-99201.md): netlink: avoid hashing the network namespace pointer (no CVSS, Linux)
- [CVE-2026-99200](https://cve.now/CVE-2026-99200.md): net: hisilicon: hisi\_femac: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99199](https://cve.now/CVE-2026-99199.md): net: hisilicon: hip04\_eth: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99198](https://cve.now/CVE-2026-99198.md): net: ethernet: actions: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99197](https://cve.now/CVE-2026-99197.md): net: mv643xx: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99196](https://cve.now/CVE-2026-99196.md): net: au1000: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99195](https://cve.now/CVE-2026-99195.md): net: ethoc: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99194](https://cve.now/CVE-2026-99194.md): net: ethernet: aeroflex: move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99193](https://cve.now/CVE-2026-99193.md): net: ti: icssm-prueth: Move setting of netops to fix crash (no CVSS, Linux)
- [CVE-2026-99192](https://cve.now/CVE-2026-99192.md): net: bcmgenet: unshare the skb before writing the control block (no CVSS, Linux)
- [CVE-2026-99191](https://cve.now/CVE-2026-99191.md): calipso: keep BIG TCP payload\_len in calipso\_skbuff\_setattr() (no CVSS, Linux)
- [CVE-2026-99190](https://cve.now/CVE-2026-99190.md): gpiolib: fix memory leak in gpiod\_set\_array\_value\_complex() on error paths (no CVSS, Linux)
- [CVE-2026-99189](https://cve.now/CVE-2026-99189.md): gpio: mxc: fix race between chained IRQ handler install and probe completion (no CVSS, Linux)
- [CVE-2026-99188](https://cve.now/CVE-2026-99188.md): net: stmmac: dwmac1000: clear the RGMII status interrupt (no CVSS, Linux)
- [CVE-2026-99187](https://cve.now/CVE-2026-99187.md): perf: Fix perf\_pmu\_migrate\_context() leaving events behind (no CVSS, Linux)
- [CVE-2026-99186](https://cve.now/CVE-2026-99186.md): x86/insn-eval: Fix shadowed segment index in get\_seg\_reg\_override\_idx() (no CVSS, Linux)
- [CVE-2026-99185](https://cve.now/CVE-2026-99185.md): firewire: core: fix race condition in split transaction handling (CVSS 8.8, Linux)
- [CVE-2026-99184](https://cve.now/CVE-2026-99184.md): accel/rocket: search every core slot when a core is removed (no CVSS, Linux)
- [CVE-2026-99183](https://cve.now/CVE-2026-99183.md): accel/rocket: search every core slot when looking up a scheduler (no CVSS, Linux)
- [CVE-2026-99182](https://cve.now/CVE-2026-99182.md): ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture (no CVSS, Linux)
- [CVE-2026-99181](https://cve.now/CVE-2026-99181.md): autofs: ignore notification errors from a replaced pipe (no CVSS, Linux)
- [CVE-2026-99180](https://cve.now/CVE-2026-99180.md): unicode: free the map after a grace period (CVSS 7.8, Linux)
- [CVE-2026-99179](https://cve.now/CVE-2026-99179.md): watch\_queue: Fix note pool publication race in watch\_queue\_set\_size() (no CVSS, Linux)
- [CVE-2026-99178](https://cve.now/CVE-2026-99178.md): x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (no CVSS, Linux)
- [CVE-2026-99177](https://cve.now/CVE-2026-99177.md): KVM: SEV: Fix page dirtying in sev\_gmem\_post\_populate() (CVSS 7.8, Linux)
- [CVE-2026-99176](https://cve.now/CVE-2026-99176.md): KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (no CVSS, Linux)
- [CVE-2026-99175](https://cve.now/CVE-2026-99175.md): fsnotify: prevent mark additions during connector teardown (no CVSS, Linux)
- [CVE-2026-99174](https://cve.now/CVE-2026-99174.md): ext4: free the sbi after a grace period (no CVSS, Linux)
- [CVE-2026-99173](https://cve.now/CVE-2026-99173.md): eventfs: Free the eventfs\_inode after an rcu grace period too (CVSS 7.8, Linux)
- [CVE-2026-99172](https://cve.now/CVE-2026-99172.md): ipc: drop the mqueue mount with kern\_unmount() on setup failure (no CVSS, Linux)
- [CVE-2026-99171](https://cve.now/CVE-2026-99171.md): ntfs3: free the sbi after a grace period (no CVSS, Linux)
- [CVE-2026-99170](https://cve.now/CVE-2026-99170.md): namespace: a mount that copy\_tree() leaves out can't take over a lock (CVSS 8.8, Linux)
- [CVE-2026-99169](https://cve.now/CVE-2026-99169.md): futex: Fix mm reuse handling for FUT\_OFF\_MMSHARED (no CVSS, Linux)
- [CVE-2026-99168](https://cve.now/CVE-2026-99168.md): mshv\_vtl: Check per-CPU register page before mmap (no CVSS, Linux)
- [CVE-2026-99167](https://cve.now/CVE-2026-99167.md): net/sched: fix use-after-free in \_\_tcf\_action\_put() (CVSS 7.8, Linux)
- [CVE-2026-99166](https://cve.now/CVE-2026-99166.md): net: rds: fix uninitialized trans dereference in CM event handler (no CVSS, Linux)
- [CVE-2026-99165](https://cve.now/CVE-2026-99165.md): sctp: revalidate output stream after association connect wait (no CVSS, Linux)
- [CVE-2026-99164](https://cve.now/CVE-2026-99164.md): spi: imx: fix slab corruption from undersized DMA bounce buffers (CVSS 7.8, Linux)
- [CVE-2026-99163](https://cve.now/CVE-2026-99163.md): tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields (CVSS 7.8, Linux)
- [CVE-2026-99162](https://cve.now/CVE-2026-99162.md): gpio: shared: fix use-after-free bug when adding shared proxies (no CVSS, Linux)
- [CVE-2026-99161](https://cve.now/CVE-2026-99161.md): i2c: viai2c-wmt: Fix clock leak in wmt\_i2c\_probe() (no CVSS, Linux)
- [CVE-2026-99160](https://cve.now/CVE-2026-99160.md): ring-buffer: Do not show buffer\_meta for CPUs without a buffer (no CVSS, Linux)
- [CVE-2026-99159](https://cve.now/CVE-2026-99159.md): ring-buffer: Fix the sub-buffer array base in rb\_meta\_subbuf\_idx() (no CVSS, Linux)
- [CVE-2026-99158](https://cve.now/CVE-2026-99158.md): ring-buffer: Fix false warning in ring\_buffer\_map\_get\_reader() (no CVSS, Linux)
- [CVE-2026-99157](https://cve.now/CVE-2026-99157.md): scsi: bsg: Pass reply\_len to bsg\_setup\_queue() to fit UFS ARPMB replies (no CVSS, Linux)
- [CVE-2026-99156](https://cve.now/CVE-2026-99156.md): scsi: st: Fix use-after-free race between st\_remove() and st\_open() (CVSS 7.8, Linux)
- [CVE-2026-99155](https://cve.now/CVE-2026-99155.md): scsi: xen/scsifront: Check for a NULL shadow entry on a backend response (no CVSS, Linux)
- [CVE-2026-99154](https://cve.now/CVE-2026-99154.md): scsi: libiscsi: Reject a negative task index from parse\_pdu\_itt (CVSS 9.8, Linux)
- [CVE-2026-99153](https://cve.now/CVE-2026-99153.md): scsi: libiscsi: Validate the ITT reflected in a Reject PDU (CVSS 9.8, Linux)
- [CVE-2026-99152](https://cve.now/CVE-2026-99152.md): scsi: libiscsi: Validate the task named by a management response (CVSS 7.5, Linux)
- [CVE-2026-99151](https://cve.now/CVE-2026-99151.md): drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions (no CVSS, Linux)
- [CVE-2026-99150](https://cve.now/CVE-2026-99150.md): drm/amdgpu: don't drop the runtime PM reference twice in amdgpu\_gpr (no CVSS, Linux)
- [CVE-2026-99149](https://cve.now/CVE-2026-99149.md): drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl (no CVSS, Linux)
- [CVE-2026-99148](https://cve.now/CVE-2026-99148.md): drm/amdgpu: keep the eviction fence until the last handle is closed (CVSS 7.0, Linux)
- [CVE-2026-99147](https://cve.now/CVE-2026-99147.md): drm/exec: don't immediately add prelocked obj to array of locked objs (no CVSS, Linux)
- [CVE-2026-99146](https://cve.now/CVE-2026-99146.md): drm/i915/dmc: Add sanity check for DMC load address (no CVSS, Linux)
- [CVE-2026-99145](https://cve.now/CVE-2026-99145.md): drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change (no CVSS, Linux)
- [CVE-2026-99144](https://cve.now/CVE-2026-99144.md): sched\_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue (no CVSS, Linux)
- [CVE-2026-99143](https://cve.now/CVE-2026-99143.md): tracing: Keep the predicate limit separate from program capacity (CVSS 7.8, Linux)
- [CVE-2026-99142](https://cve.now/CVE-2026-99142.md): tracing: Check operator stack capacity before pushing (CVSS 7.1, Linux)
- [CVE-2026-99141](https://cve.now/CVE-2026-99141.md): tracing: Fix crash in print\_graph\_function\_event() (no CVSS, Linux)
- [CVE-2026-99140](https://cve.now/CVE-2026-99140.md): tracing: Fix hist trigger timestamps for buffered events (no CVSS, Linux)
- [CVE-2026-99139](https://cve.now/CVE-2026-99139.md): tcp: fix use-after-free in do\_tcp\_getsockopt(TCP\_CONGESTION) (no CVSS, Linux)
- [CVE-2026-99138](https://cve.now/CVE-2026-99138.md): tcp: fix use-after-free in do\_tcp\_getsockopt(TCP\_CC\_INFO) (no CVSS, Linux)
- [CVE-2026-99137](https://cve.now/CVE-2026-99137.md): cifs: don't update i\_size in cifs\_do\_truncate without a cached handle (no CVSS, Linux)
- [CVE-2026-99136](https://cve.now/CVE-2026-99136.md): dm-crypt: fix a tiny race condition in crypt\_dec\_pending (CVSS 7.0, Linux)
- [CVE-2026-99135](https://cve.now/CVE-2026-99135.md): dm-integrity: fix infinite loop on discard with large tag size (no CVSS, Linux)
- [CVE-2026-99134](https://cve.now/CVE-2026-99134.md): mac802154: fix data race and NULL deref on local-\>assoc\_dev (no CVSS, Linux)
- [CVE-2026-99133](https://cve.now/CVE-2026-99133.md): net/iucv: fix the recvmsg window update (no CVSS, Linux)
- [CVE-2026-99132](https://cve.now/CVE-2026-99132.md): xfs: don't hold buffer locks across sync transaction commit in xfs\_sync\_sb\_buf (no CVSS, Linux)
- [CVE-2026-99131](https://cve.now/CVE-2026-99131.md): xfs: fix capability check in xfs (CVSS 8.2, Linux)
- [CVE-2026-99130](https://cve.now/CVE-2026-99130.md): io\_uring/cancel: don't spin on local work the task can't run (no CVSS, Linux)
- [CVE-2026-99129](https://cve.now/CVE-2026-99129.md): selinux: fix BPF token permission checks (no CVSS, Linux)
- [CVE-2026-99128](https://cve.now/CVE-2026-99128.md): sctp: validate chunk length in the inqueue parser (no CVSS, Linux)
- [CVE-2026-99127](https://cve.now/CVE-2026-99127.md): page\_pool: keep frag\_offset aligned for odd-sized requests (no CVSS, Linux)
- [CVE-2026-99126](https://cve.now/CVE-2026-99126.md): s390/ctcm: Prevent XID null dereference (no CVSS, Linux)
- [CVE-2026-99125](https://cve.now/CVE-2026-99125.md): s390/pai: Handle multiple PMU stop callback invocations (no CVSS, Linux)
- [CVE-2026-99124](https://cve.now/CVE-2026-99124.md): s390/pci: Fix leak of uninitialized kernel data in SCLP report (no CVSS, Linux)
- [CVE-2026-99123](https://cve.now/CVE-2026-99123.md): vsock/virtio: validate packet source for connected sockets (CVSS 7.1, Linux)
- [CVE-2026-99122](https://cve.now/CVE-2026-99122.md): vsock/vmci: validate packet source for connected sockets (CVSS 7.3, Linux)
- [CVE-2026-99121](https://cve.now/CVE-2026-99121.md): ipv4: avoid divide by zero in fib\_rebalance (no CVSS, Linux)
- [CVE-2026-99120](https://cve.now/CVE-2026-99120.md): KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes (no CVSS, Linux)
- [CVE-2026-99119](https://cve.now/CVE-2026-99119.md): drm/amdgpu/userq: actually validate userq BOs (no CVSS, Linux)
- [CVE-2026-99118](https://cve.now/CVE-2026-99118.md): drm/i915/dmc: Harden DMC firmware payload parsing (no CVSS, Linux)
- [CVE-2026-99117](https://cve.now/CVE-2026-99117.md): net: bridge: mcast: don't truncate the port group walk on teardown (CVSS 7.8, Linux)
- [CVE-2026-99116](https://cve.now/CVE-2026-99116.md): net: psp: do not inherit the Rx association on clone (CVSS 7.8, Linux)
- [CVE-2026-99115](https://cve.now/CVE-2026-99115.md): ksmbd: fill in FileSysIdentifier in FS\_POSIX\_INFORMATION (no CVSS, Linux)
- [CVE-2026-99114](https://cve.now/CVE-2026-99114.md): ksmbd: initialize FileSystemControlFlags in FS\_CONTROL\_INFORMATION (no CVSS, Linux)
- [CVE-2026-99113](https://cve.now/CVE-2026-99113.md): ksmbd: zero the FS\_OBJECT\_ID\_INFORMATION buffer before filling it in (no CVSS, Linux)
- [CVE-2026-99112](https://cve.now/CVE-2026-99112.md): net/sched: cls\_flower: validate mask pointer after nla\_next() (CVSS 7.1, Linux)
- [CVE-2026-99111](https://cve.now/CVE-2026-99111.md): smb: client: fix data corruption with concurrent writes and O\_TRUNC (no CVSS, Linux)
- [CVE-2026-99110](https://cve.now/CVE-2026-99110.md): smb: client: fix heap overflow in cifs\_do\_set\_acl() (CVSS 7.0, Linux)
- [CVE-2026-99109](https://cve.now/CVE-2026-99109.md): smb: client: reject SetEA requests that do not fit the request buffer (CVSS 7.8, Linux)
- [CVE-2026-99108](https://cve.now/CVE-2026-99108.md): ntfs: fix FITRIM range alignment (no CVSS, Linux)
- [CVE-2026-99107](https://cve.now/CVE-2026-99107.md): ntfs: fix incorrect MFT record pointer passed to ntfs\_attr\_record\_resize (CVSS 7.8, Linux)
- [CVE-2026-99106](https://cve.now/CVE-2026-99106.md): drm/amdgpu: free the userptr ranges when a CS fails after parser\_bos (no CVSS, Linux)
- [CVE-2026-99105](https://cve.now/CVE-2026-99105.md): sched\_ext: Fix stall when a task enqueued with SCX\_ENQ\_LAST lands back on its CPU's local DSQ (no CVSS, Linux)
- [CVE-2026-99104](https://cve.now/CVE-2026-99104.md): sched\_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor (no CVSS, Linux)
- [CVE-2026-99103](https://cve.now/CVE-2026-99103.md): workqueue: Fix unbound pool lifetime for pending pwqs (no CVSS, Linux)
- [CVE-2026-99102](https://cve.now/CVE-2026-99102.md): ntfs: take invalidate\_lock in ntfs\_setattr\_size() (no CVSS, Linux)
- [CVE-2026-99101](https://cve.now/CVE-2026-99101.md): ntfs: move attribute payload before shrinking its record (no CVSS, Linux)
- [CVE-2026-110541](https://cve.now/CVE-2026-110541.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-101272](https://cve.now/CVE-2026-101272.md): Incorrect session validation for API-created shredder exports (CVSS 2.3, pretix)
- [CVE-2026-101274](https://cve.now/CVE-2026-101274.md): When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the (CVSS 6.9, pretix)
- [CVE-2026-110540](https://cve.now/CVE-2026-110540.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 7.1, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-101273](https://cve.now/CVE-2026-101273.md): Giftcard enumeration (CVSS 5.3, pretix)
- [CVE-2026-103792](https://cve.now/CVE-2026-103792.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 9.6, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-103779](https://cve.now/CVE-2026-103779.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 8.3, Dell PowerProtect Data Domain)
- [CVE-2026-112198](https://cve.now/CVE-2026-112198.md): Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App (CVSS 8.3, Tactis NoviGest Desktop App)
- [CVE-2026-103799](https://cve.now/CVE-2026-103799.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 9.6, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-112197](https://cve.now/CVE-2026-112197.md): Missing Authentication for Critical Function in Tactis' NoviGest Desktop App (CVSS 9.4, Tactis NoviGest Desktop App)
- [CVE-2026-103780](https://cve.now/CVE-2026-103780.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-87879](https://cve.now/CVE-2026-87879.md): Sensitive information disclosure due to improper token validation. (CVSS 5.9, Acronis Cyber Protect)
- [CVE-2026-87878](https://cve.now/CVE-2026-87878.md): Linux binaries have executable stack attribute enabled. (CVSS 6.3, Acronis Cyber Protect)
- [CVE-2026-87102](https://cve.now/CVE-2026-87102.md): Sensitive information disclosure and manipulation due to improper token validation. (CVSS 7.4, Acronis Cyber Protect)
- [CVE-2026-87100](https://cve.now/CVE-2026-87100.md): Protection mechanism failure due to missing binary hardening in Linux executables. (CVSS 3.6, Acronis Cyber Protect)
- [CVE-2026-87099](https://cve.now/CVE-2026-87099.md): Cross-site scripting (XSS) vulnerability due to improper input validation. (CVSS 5.7, Acronis Cyber Protect)
- [CVE-2025-30414](https://cve.now/CVE-2025-30414.md): Local privilege escalation due to improper authentication. (CVSS 7.1, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2026-87098](https://cve.now/CVE-2026-87098.md): Sensitive information disclosure due to improper authorization. (CVSS 3.1, Acronis Cyber Protect)
- [CVE-2026-87880](https://cve.now/CVE-2026-87880.md): Sensitive information disclosure due to missing SSL certificate verification affecting one component. (CVSS 6.8, Acronis Cyber Protect)
- [CVE-2026-87103](https://cve.now/CVE-2026-87103.md): Sensitive information disclosure and manipulation due to improper token validation. (CVSS 7.4, Acronis Cyber Protect)
- [CVE-2026-86377](https://cve.now/CVE-2026-86377.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 7.6, Dell PowerProtect Data Domain)
- [CVE-2026-87101](https://cve.now/CVE-2026-87101.md): Sensitive information disclosure due to improper token validation. (CVSS 6.2, Acronis Cyber Protect)
- [CVE-2026-87097](https://cve.now/CVE-2026-87097.md): Sensitive information disclosure due to insufficiently protected credentials. (CVSS 5.3, Acronis Cyber Protect)
- [CVE-2026-86378](https://cve.now/CVE-2026-86378.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 8.8, Dell PowerProtect Data Domain)
- [CVE-2026-86379](https://cve.now/CVE-2026-86379.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 7.2, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-86380](https://cve.now/CVE-2026-86380.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-86383](https://cve.now/CVE-2026-86383.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 rele (CVSS 6.8, Dell PowerProtect Data Domain)
- [CVE-2026-86384](https://cve.now/CVE-2026-86384.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-86385](https://cve.now/CVE-2026-86385.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability. (CVSS 8.8, Dell PowerProtect Data Domain)
- [CVE-2026-86386](https://cve.now/CVE-2026-86386.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 4.3, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-86388](https://cve.now/CVE-2026-86388.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 5.3, Dell PowerProtect Data Domain)
- [CVE-2026-92665](https://cve.now/CVE-2026-92665.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 5.3, Dell PowerProtect Data Domain)
- [CVE-2026-105457](https://cve.now/CVE-2026-105457.md): Authenticated Arbitrary Local File Read via Path Traversal in HAVELSAN's Liman MYS (CVSS 6.5, HAVELSAN Liman MYS)
- [CVE-2026-86389](https://cve.now/CVE-2026-86389.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-86390](https://cve.now/CVE-2026-86390.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 6.5, Dell PowerProtect Data Domain)
- [CVE-2026-86391](https://cve.now/CVE-2026-86391.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 6.4, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-86392](https://cve.now/CVE-2026-86392.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 4.9, Dell PowerProtect Data Domain)
- [CVE-2026-86393](https://cve.now/CVE-2026-86393.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-14571](https://cve.now/CVE-2026-14571.md): SQL injection (SQLi) in the user authentication module of Futurum Software (CVSS 9.1, Futurum Software User Authentication Module)
- [CVE-2026-86394](https://cve.now/CVE-2026-86394.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025… (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-86395](https://cve.now/CVE-2026-86395.md): Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13. (CVSS 7.2, Dell PowerProtect Data Domain Virtual Edition)
- [CVE-2026-86396](https://cve.now/CVE-2026-86396.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025… (CVSS 8.8, Dell PowerProtect Data Domain)
- [CVE-2026-86397](https://cve.now/CVE-2026-86397.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025… (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-86398](https://cve.now/CVE-2026-86398.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025… (CVSS 8.8, Dell PowerProtect Data Domain)
- [CVE-2026-86399](https://cve.now/CVE-2026-86399.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025… (CVSS 7.2, Dell PowerProtect Data Domain)
- [CVE-2026-86400](https://cve.now/CVE-2026-86400.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025… (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-86401](https://cve.now/CVE-2026-86401.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 2.7, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-90717](https://cve.now/CVE-2026-90717.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 9.1, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-16020](https://cve.now/CVE-2026-16020.md): Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform (CVSS 5.4, Fazile BACAK DefterAsist Financial Advisor Platform)
- [CVE-2026-90719](https://cve.now/CVE-2026-90719.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 2.7, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-90720](https://cve.now/CVE-2026-90720.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 6.7, Dell PowerProtect Data Domain)
- [CVE-2026-90721](https://cve.now/CVE-2026-90721.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 3.4, Dell PowerProtect Data Domain)
- [CVE-2026-90723](https://cve.now/CVE-2026-90723.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 2.7, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-90724](https://cve.now/CVE-2026-90724.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 2.7, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-118435](https://cve.now/CVE-2026-118435.md): Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation. (CVSS 5.4, Samsung Open Source escargot)
- [CVE-2026-85655](https://cve.now/CVE-2026-85655.md): Enable Media Replace \<= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow (CVSS 4.3, shortpixel Enable Media Replace)
- [CVE-2026-101935](https://cve.now/CVE-2026-101935.md): Echo Knowledge Base \<= 17.214.0 - Reflected Cross-Site Scripting via 'new\_kb\_config' Parameter (CVSS 6.1, echoplugins Echo Knowledge Base – Documentation, FAQs, Chat…)
- [CVE-2026-92797](https://cve.now/CVE-2026-92797.md): Memberpress \<= 1.14.1 - Cross-Site Request Forgery via 'user\_email' Parameter (CVSS 8.8, Memberpress)
- [CVE-2026-63286](https://cve.now/CVE-2026-63286.md): Database backups are vulnerable to offline attacks. (CVSS 7.1, Axis Communications AB AXIS Camera Station Pro · Axis Commu…)
- [CVE-2026-109975](https://cve.now/CVE-2026-109975.md): Cozy Blocks \<= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute (CVSS 6.4, cozythemes Cozy Blocks – Website Builder & Business Growth…)
- [CVE-2026-76005](https://cve.now/CVE-2026-76005.md): WP Inventory Manager \<= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort\_order' Shortcode Attribute (CVSS 6.5, chuck1982 WP Inventory Manager)
- [CVE-2026-118169](https://cve.now/CVE-2026-118169.md): Hustle \<= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta\_label' Parameter (CVSS 4.9, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2026-104743](https://cve.now/CVE-2026-104743.md): Tainacan \<= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp\_file' Parameter via Mass Assignment (CVSS 4.9, Tainacan)
- [CVE-2026-76780](https://cve.now/CVE-2026-76780.md): BeyondSEO \<= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation (CVSS 6.3, rankingcoach BeyondSEO – AI SEO to Improve Rankings, Listin…)
- [CVE-2026-110185](https://cve.now/CVE-2026-110185.md): Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More \<= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters (CVSS 5.9, bitpressadmin Bit Flows: AI Agent Automation & Integrations…)
- [CVE-2026-116750](https://cve.now/CVE-2026-116750.md): VikRentCar Car Rental Management System \<= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute (CVSS 6.5, e4jvikwp VikRentCar Car Rental Management System)
- [CVE-2026-109218](https://cve.now/CVE-2026-109218.md): Contact Manager \<= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass (CVSS 9.8, kleor Contact Manager)
- [CVE-2026-109370](https://cve.now/CVE-2026-109370.md): Document Embedder \<= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute (CVSS 6.4, bplugins Document Embedder – let visitors read files withou…)
- [CVE-2026-77871](https://cve.now/CVE-2026-77871.md): Post Snippets \<= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, saadiqbal Post Snippets – Custom WordPress Code Snippets Cu…)
- [CVE-2026-107710](https://cve.now/CVE-2026-107710.md): Hustle \<= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title (CVSS 6.4, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2026-109988](https://cve.now/CVE-2026-109988.md): Product Addons for Woocommerce \<= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter (CVSS 4.4, acowebs Product Addons for Woocommerce – Product Options wi…)
- [CVE-2026-2839](https://cve.now/CVE-2026-2839.md): Advanced Custom Fields: Extended \<= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints (CVSS 5.3, hwk-fr Advanced Custom Fields: Extended)
- [CVE-2026-116761](https://cve.now/CVE-2026-116761.md): CMB2 \<= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form (CVSS 5.4, jtsternberg CMB2)
- [CVE-2026-108366](https://cve.now/CVE-2026-108366.md): easy.jobs \<= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute (CVSS 6.4, wpdevteam easy.jobs – AI powered Job Listing, Job Board, Ca…)
- [CVE-2026-110071](https://cve.now/CVE-2026-110071.md): Mang Board \<= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute (CVSS 6.4, kitae-park Mang Board)
- [CVE-2026-111111](https://cve.now/CVE-2026-111111.md): Prime Slider \<= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content\_Guard Regex Quote-Escape (CVSS 7.2, bdthemes Prime Slider – Hero Slider, Carousel, WooCommerce…)
- [CVE-2026-111213](https://cve.now/CVE-2026-111213.md): Travelly \<= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter (CVSS 4.3, magepeopleteam Travelly – Tour & Travel Booking Manager for…)
- [CVE-2026-116610](https://cve.now/CVE-2026-116610.md): Clean Login \<= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save\_post' Hook (CVSS 4.3, hornero Clean Login)
- [CVE-2026-116749](https://cve.now/CVE-2026-116749.md): VikRentCar Car Rental Management System \<= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute (CVSS 6.4, e4jvikwp VikRentCar Car Rental Management System)
- [CVE-2026-92098](https://cve.now/CVE-2026-92098.md): Webheadcoder Multi-Step Forms for Contact Form 7 \<= 4.7 - Reflected Cross-Site Scripting via 'l10n\_print\_after' Parameter (CVSS 6.1, webheadllc Webheadcoder Multi-Step Forms for Contact Form)
- [CVE-2026-109980](https://cve.now/CVE-2026-109980.md): Related Posts for WordPress \<= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp\_view' Parameter (CVSS 4.3, barrykooij Related Posts for WordPress)
- [CVE-2026-104729](https://cve.now/CVE-2026-104729.md): Avada (Fusion) Builder \<= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab\_index' and 'empty\_notice' Shortcode Attributes (CVSS 6.4, themefusion Avada (Fusion) Builder)
- [CVE-2026-118164](https://cve.now/CVE-2026-118164.md): If-So Dynamic Content \<= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter (CVSS 6.4, ifso If-So Dynamic Content – Elementor & All Page Builders…)
- [CVE-2026-100175](https://cve.now/CVE-2026-100175.md): Postie \<= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink (CVSS 5.4, wayneallen-1 Postie)
- [CVE-2026-109384](https://cve.now/CVE-2026-109384.md): The Innovative Form Builder \<= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public… (CVSS 8.8, melograno The Innovative Form Builder – IvyForms)
- [CVE-2026-77188](https://cve.now/CVE-2026-77188.md): Waitlist Woocommerce ( Back in stock notifier ) \<= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute (CVSS 6.4, xootix Waitlist Woocommerce)
- [CVE-2026-110020](https://cve.now/CVE-2026-110020.md): Rich Showcase for Google Reviews \<= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw\_auth\_code' Site Secret Disclosure via grw-builder Admin Page (CVSS 6.5, widgetpack Rich Showcase for Google Reviews)
- [CVE-2026-109979](https://cve.now/CVE-2026-109979.md): Related Posts for WordPress \<= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp\_create\_link' Parameter (CVSS 4.3, barrykooij Related Posts for WordPress)
- [CVE-2026-111120](https://cve.now/CVE-2026-111120.md): VikRentCar Car Rental Management System \<= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext\_update\_tmpl' AJAX Task (CVSS 8.8, e4jvikwp VikRentCar Car Rental Management System)
- [CVE-2026-104740](https://cve.now/CVE-2026-104740.md): If-So Dynamic Content \<= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute (CVSS 6.4, ifso If-So Dynamic Content – Elementor & All Page Builders…)
- [CVE-2026-111372](https://cve.now/CVE-2026-111372.md): AI ChatBot for WooCommerce \<= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld\_rag\_manual\_sync AJAX Action (CVSS 4.3, quantumcloud AI ChatBot for WooCommerce – WoowBot)
- [CVE-2026-109978](https://cve.now/CVE-2026-109978.md): Cozy Blocks \<= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute (CVSS 6.4, cozythemes Cozy Blocks – Website Builder & Business Growth…)
- [CVE-2026-76058](https://cve.now/CVE-2026-76058.md): PayPal Brasil para WooCommerce \<= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc\_activation\_update' Action (CVSS 5.3, odefranca PayPal Brasil para WooCommerce)
- [CVE-2026-109972](https://cve.now/CVE-2026-109972.md): s2Member \<= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date\_format' Shortcode Attribute (CVSS 6.4, clavaque s2Member – Excellent for All Kinds of Memberships,…)
- [CVE-2026-111068](https://cve.now/CVE-2026-111068.md): DesignSetGo \<= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute (CVSS 4.4, justinnealey DesignSetGo)
- [CVE-2026-109590](https://cve.now/CVE-2026-109590.md): Travelly \<= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes (CVSS 6.4, magepeopleteam Travelly – Tour & Travel Booking Manager for…)
- [CVE-2026-109385](https://cve.now/CVE-2026-109385.md): UiChemy \<= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL (CVSS 6.4, posimyththemes UiChemy – Convert Figma, Prompts and AI Buil…)
- [CVE-2026-103996](https://cve.now/CVE-2026-103996.md): If-So Dynamic Content \<= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute (CVSS 6.4, ifso If-So Dynamic Content – Elementor & All Page Builders…)
- [CVE-2026-110662](https://cve.now/CVE-2026-110662.md): MxChat \<= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat\_save\_rating (CVSS 7.2, MxChat – AI Chatbot & Content Generation for WordPress)
- [CVE-2026-109381](https://cve.now/CVE-2026-109381.md): Event Booking Manager for WooCommerce \<= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter (CVSS 7.2, magepeopleteam Event Booking Manager for WooCommerce – Sell…)
- [CVE-2026-103370](https://cve.now/CVE-2026-103370.md): Awesome Support \<= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion (CVSS 6.4, awesomesupport Awesome Support – WordPress HelpDesk & Suppo…)
- [CVE-2026-116609](https://cve.now/CVE-2026-116609.md): WP Visitor Statistics (Real Time Traffic) \<= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute (CVSS 6.5, osamaesh WP Visitor Statistics)
- [CVE-2026-115281](https://cve.now/CVE-2026-115281.md): Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute (CVSS 6.8, Recipe Card Blocks Lite)
- [CVE-2026-115255](https://cve.now/CVE-2026-115255.md): WP Roster \< 2.35 - Unauthenticated Roster Member Deletion (CVSS 5.3, WP Roster)
- [CVE-2026-115225](https://cve.now/CVE-2026-115225.md): Smart Popup by Supsystic \< 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup (CVSS 5.8, Customer Engagement System)
- [CVE-2026-115224](https://cve.now/CVE-2026-115224.md): Smart Popup by Supsystic \< 2.0.2 - Admin+ SQLi via Popup Page/Category Binding (CVSS 4.1, Customer Engagement System)
- [CVE-2026-113813](https://cve.now/CVE-2026-113813.md): PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure (CVSS 6.5, PayPlug for WooCommerce)
- [CVE-2026-113494](https://cve.now/CVE-2026-113494.md): GeoDirectory \< 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd\_post\_content Shortcode (CVSS 2.7, GeoDirectory)
- [CVE-2026-113488](https://cve.now/CVE-2026-113488.md): GeoDirectory \< 2.8.196 - Contributor+ Stored XSS via gd\_post\_badge 'cta' Attribute (CVSS 6.8, GeoDirectory)
- [CVE-2026-113487](https://cve.now/CVE-2026-113487.md): GeoDirectory \< 2.8.196 - Contributor+ Stored XSS via gd\_post\_badge 'link' Attribute (CVSS 6.8, GeoDirectory)
- [CVE-2026-113486](https://cve.now/CVE-2026-113486.md): Media Library Assistant \< 3.42 - Trashed Attachment Deletion via CSRF (CVSS 6.5, Media Library Assistant)
- [CVE-2026-113485](https://cve.now/CVE-2026-113485.md): Media Library Assistant \< 3.42 - Bulk Attachment Deletion via CSRF (CVSS 6.5, Media Library Assistant)
- [CVE-2026-111967](https://cve.now/CVE-2026-111967.md): MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute (CVSS 6.8, MP3 Audio Player)
- [CVE-2026-111961](https://cve.now/CVE-2026-111961.md): Royal MCP \< 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish\_posts Bypass via elementor\_clone\_page (CVSS 3.8, Royal MCP)
- [CVE-2026-111960](https://cve.now/CVE-2026-111960.md): Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp\_search Ability (CVSS 4.3, Royal MCP)
- [CVE-2026-111577](https://cve.now/CVE-2026-111577.md): GoSMTP \< 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings (CVSS 7.2, GoSMTP)
- [CVE-2026-111032](https://cve.now/CVE-2026-111032.md): Welcart e-Commerce \< 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item\_sku\_ajax (CVSS 3.8, Welcart e-Commerce)
- [CVE-2026-111031](https://cve.now/CVE-2026-111031.md): Welcart e-Commerce \< 2.12.6 - Unauthenticated Open Redirect via 'usces\_referer' Parameter (CVSS 4.7, Welcart e-Commerce)
- [CVE-2026-111027](https://cve.now/CVE-2026-111027.md): Welcart e-Commerce \< 2.12.6 - Editor+ SQLi via 'log\_id' Parameter (CVSS 6.8, Welcart e-Commerce)
- [CVE-2026-111021](https://cve.now/CVE-2026-111021.md): Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms\_mobiles' Parameter (CVSS 7.1, افزونه پیامک ووکامرس | Persian WooCommerce SMS)
- [CVE-2026-110691](https://cve.now/CVE-2026-110691.md): WPOrLogin \< 3.1.0 - Unauthenticated Hide Login Slug Update (CVSS 6.5, WPOrLogin)
- [CVE-2026-110524](https://cve.now/CVE-2026-110524.md): Copy Anything to Clipboard \< 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute (CVSS 6.8, Copy Anything to Clipboard for WordPress)
- [CVE-2026-110509](https://cve.now/CVE-2026-110509.md): Essential Addons for Elementor \< 6.8.7 - Unauthenticated Private Post Meta Disclosure via load\_more AJAX Handler (CVSS 5.3, Essential Addons for Elementor)
- [CVE-2026-110507](https://cve.now/CVE-2026-110507.md): Page Builder by SiteOrigin \< 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments (CVSS 2.7, Page Builder by SiteOrigin)
- [CVE-2026-110506](https://cve.now/CVE-2026-110506.md): Page Builder by SiteOrigin \< 2.38.0 - Contributor+ Stored XSS via panels\_info.class (CVSS 6.8, Page Builder by SiteOrigin)
- [CVE-2026-110292](https://cve.now/CVE-2026-110292.md): PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug\_create\_intent (CVSS 6.5, PayPlug for WooCommerce)
- [CVE-2026-107100](https://cve.now/CVE-2026-107100.md): Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr\_get\_page\_content (CVSS 5.3, Royal Addons for Elementor)
- [CVE-2026-107098](https://cve.now/CVE-2026-107098.md): Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting (CVSS 6.8, Royal Addons for Elementor)
- [CVE-2026-107097](https://cve.now/CVE-2026-107097.md): Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp\_subscribe (CVSS 5.3, Royal Addons for Elementor)
- [CVE-2026-106647](https://cve.now/CVE-2026-106647.md): Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision (CVSS 3.8, Royal Addons for Elementor)
- [CVE-2026-106003](https://cve.now/CVE-2026-106003.md): Court Reservation \< 1.12.4 - Unauthenticated Reservation Type Addition and Deletion (CVSS 5.3, Court Reservation)
- [CVE-2026-106002](https://cve.now/CVE-2026-106002.md): Court Reservation \< 1.12.4 - Unauthenticated Arbitrary Challenge Deletion (CVSS 5.3, Court Reservation)
- [CVE-2026-105997](https://cve.now/CVE-2026-105997.md): Booking Package \< 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient (CVSS 5.3, Booking Package)
- [CVE-2026-105972](https://cve.now/CVE-2026-105972.md): WooCommerce Menu Cart \< 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute (CVSS 7.5, Menu Cart for WooCommerce)
- [CVE-2026-104694](https://cve.now/CVE-2026-104694.md): Thrive Automator \< 11.2 - Editor+ Blind SQLi via 'additional' Parameter (CVSS 6.8, Thrive Automator)
- [CVE-2026-103688](https://cve.now/CVE-2026-103688.md): Checkout Files Upload for WooCommerce \< 2.4.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Checkout Files Upload for WooCommerce)
- [CVE-2026-103382](https://cve.now/CVE-2026-103382.md): Casso Auto-confirm Bank Transfer \< 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation (CVSS 5.3, Casso Flow)
- [CVE-2026-103372](https://cve.now/CVE-2026-103372.md): Payconiq for WooCommerce \<= 1.0.4 - Unauthenticated Order Key Disclosure (CVSS 5.3, Payconiq)
- [CVE-2026-103331](https://cve.now/CVE-2026-103331.md): UniPAY Payment Gateway For WooCommerce \<= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret (CVSS 5.3, UniPAY Payment Gateway For WooCommerce)
- [CVE-2026-15323](https://cve.now/CVE-2026-15323.md): Product Designer for WooCommerce WordPress | Lumise \<= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages\[\*\].image' Parameter in Cart JSON Upload (CVSS 7.5, King-Theme Product Designer for WooCommerce WordPress | Lum…)
- [CVE-2026-109236](https://cve.now/CVE-2026-109236.md): Customer Email Verification for WooCommerce \<= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer\_email\_verify' Parameter (CVSS 4.8, zorem Customer Email Verification for WooCommerce)
- [CVE-2026-115522](https://cve.now/CVE-2026-115522.md): Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python (CVSS 5.3, Google Agent Development Kit (ADK) for Python)
- [CVE-2026-104384](https://cve.now/CVE-2026-104384.md): Insufficiently protected credentials in EagleCloud Aquila on-premises version (CVSS 8.7, EagleCloud Aquila)
- [CVE-2026-104383](https://cve.now/CVE-2026-104383.md): Code injection in EagleCloud Aquila on-premises version (CVSS 9.4, EagleCloud Aquila)
- [CVE-2026-99100](https://cve.now/CVE-2026-99100.md): wifi: p54: validate firmware record lengths (no CVSS, Linux)
- [CVE-2026-118276](https://cve.now/CVE-2026-118276.md): a2ui-project a2ui Parser expression\_parser.ts formatString resource consumption (CVSS 5.1, a2ui-project a2ui)
- [CVE-2026-111727](https://cve.now/CVE-2026-111727.md): Appointment Booking Calendar \<= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs\_text\_submitbtn' Parameter (CVSS 6.4, codepeople Appointment Booking Calendar)
- [CVE-2026-1928](https://cve.now/CVE-2026-1928.md): Rank Math SEO \<= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution (CVSS 8.8, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2026-116613](https://cve.now/CVE-2026-116613.md): Animated Text Block \<= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute (CVSS 7.5, bplugins Animated Text Block – Add Typing and Looping Text…)
- [CVE-2026-111255](https://cve.now/CVE-2026-111255.md): affiliate-toolkit \<= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp\_product\_largeimageurl' Parameter (CVSS 7.5, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2026-118275](https://cve.now/CVE-2026-118275.md): a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption (CVSS 6.9, a2ui-project a2ui)
- [CVE-2026-118384](https://cve.now/CVE-2026-118384.md): GNU mtools before 4.0.50 has an out-of-bounds write in parse\_vses in vfat.c. (CVSS 6.1, GNU mtools)
- [CVE-2026-118274](https://cve.now/CVE-2026-118274.md): a2ui-project a2ui Binder generic-binder.ts resource consumption (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-118273](https://cve.now/CVE-2026-118273.md): a2ui-project a2ui data-model.ts DataModel.set resource consumption (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-107745](https://cve.now/CVE-2026-107745.md): AI Engine \<= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter (CVSS 4.2, tigroumeow AI Engine – MCP Server & AI Chatbot for WordPres…)
- [CVE-2026-109209](https://cve.now/CVE-2026-109209.md): All-in-One Video Gallery \<= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC (CVSS 6.4, plugins360 All-in-One Video Gallery – Video Player & Galler…)
- [CVE-2026-111314](https://cve.now/CVE-2026-111314.md): affiliate-toolkit \<= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp\_product\_producturl' Parameter (CVSS 7.2, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2026-97019](https://cve.now/CVE-2026-97019.md): AMP for WP \<= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-\*' Shortcode Attribute (CVSS 7.2, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2026-109999](https://cve.now/CVE-2026-109999.md): AI Marketing Expert \<= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter (CVSS 7.2, nalam-1 AI Marketing Expert — AI Email Marketing, AI Conten…)
- [CVE-2026-109974](https://cve.now/CVE-2026-109974.md): All-in-One Video Gallery \<= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more\_link' Shortcode Attribute (CVSS 6.4, plugins360 All-in-One Video Gallery – Video Player & Galler…)
- [CVE-2026-84999](https://cve.now/CVE-2026-84999.md): Pie Register Premium \<= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg\_file\_upload AJAX Handler (CVSS 9.8, Pie Register Premium)
- [CVE-2026-107625](https://cve.now/CVE-2026-107625.md): Ultimate Member \<= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user\_url' Profile Field (CVSS 6.4, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-115624](https://cve.now/CVE-2026-115624.md): GROWI contains a missing authorization check vulnerability in its collaborative editing feature. (CVSS 5.3, GROWI)
- [CVE-2026-109848](https://cve.now/CVE-2026-109848.md): GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled (CVSS 4.2, GROWI)
- [CVE-2026-105272](https://cve.now/CVE-2026-105272.md): GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controll (CVSS 4.2, GROWI)
- [CVE-2026-118378](https://cve.now/CVE-2026-118378.md): Tabularis before 0.28.0 SQL Injection via MCP describe\_table table\_name (CVSS 8.5, TabularisDB tabularis)
- [CVE-2026-118377](https://cve.now/CVE-2026-118377.md): mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks (CVSS 8.7, mewebstudio pos)
- [CVE-2026-118376](https://cve.now/CVE-2026-118376.md): WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses (CVSS 6.0, Tencent WeKnora)
- [CVE-2026-118375](https://cve.now/CVE-2026-118375.md): llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma\_recv() (CVSS 9.2, ggml-org llama.cpp)
- [CVE-2026-118374](https://cve.now/CVE-2026-118374.md): LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response (CVSS 8.2, OpenBSD LibreSSL)
- [CVE-2026-118373](https://cve.now/CVE-2026-118373.md): LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() (CVSS 6.3, OpenBSD LibreSSL)
- [CVE-2026-118372](https://cve.now/CVE-2026-118372.md): LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path (CVSS 6.3, OpenBSD LibreSSL)
- [CVE-2026-118371](https://cve.now/CVE-2026-118371.md): LibreSSL through 4.4.0 CRLF Injection via OCSP\_sendreq\_new() Request Line (CVSS 6.3, OpenBSD LibreSSL)
- [CVE-2026-118370](https://cve.now/CVE-2026-118370.md): libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes (CVSS 8.2, libexpat)
- [CVE-2026-117610](https://cve.now/CVE-2026-117610.md): libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser (CVSS 8.2, libexpat)
- [CVE-2026-117609](https://cve.now/CVE-2026-117609.md): rtl\_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder (CVSS 7.1, merbanan rtl\_433)
- [CVE-2026-117608](https://cve.now/CVE-2026-117608.md): Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow (CVSS 6.9, assimp)
- [CVE-2026-117607](https://cve.now/CVE-2026-117607.md): Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import (CVSS 8.6, thexerteproject xerteonlinetoolkits)
- [CVE-2026-117606](https://cve.now/CVE-2026-117606.md): NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions (CVSS 5.3, Blair2004 NexoPOS)
- [CVE-2026-117605](https://cve.now/CVE-2026-117605.md): nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers (CVSS 5.3, nopSolutions nopCommerce)
- [CVE-2015-20129](https://cve.now/CVE-2015-20129.md): CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ (CVSS 8.6, CrushFTP)
- [CVE-2014-125138](https://cve.now/CVE-2014-125138.md): C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields (CVSS 8.7, C97net qEngine CMS · C97net Kemana Directory +1)
- [CVE-2014-125137](https://cve.now/CVE-2014-125137.md): C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php (CVSS 7.1, C97net qEngine CMS · C97net Kemana Directory +1)
- [CVE-2014-125136](https://cve.now/CVE-2014-125136.md): C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup (CVSS 8.2, C97net qEngine CMS · C97net Kemana Directory +1)
- [CVE-2013-20009](https://cve.now/CVE-2013-20009.md): Linksys WAG200G through 1.01.06 Stored XSS via policy\_name Parameter (CVSS 4.8, Linksys WAG200G)
- [CVE-2013-20008](https://cve.now/CVE-2013-20008.md): Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password (CVSS 7.0, Linksys WAG200G)
- [CVE-2013-20007](https://cve.now/CVE-2013-20007.md): Linksys WAG200G through 1.01.06 OS Command Injection via timer\_interval in setup.cgi (CVSS 8.6, Linksys WAG200G)
- [CVE-2026-118272](https://cve.now/CVE-2026-118272.md): a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-106013](https://cve.now/CVE-2026-106013.md): Jupiter X Core \<= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth\_verifier Parameter (CVSS 9.8, artbees Jupiter X Core)
- [CVE-2026-118271](https://cve.now/CVE-2026-118271.md): a2ui-project a2ui data-context Resolver data-context.ts resource consumption (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-110879](https://cve.now/CVE-2026-110879.md): jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) (CVSS 9.8, FasterXML jackson-databind)
- [CVE-2026-110747](https://cve.now/CVE-2026-110747.md): jackson-dataformat-protobuf: integer overflow in ProtobufParser.\_readStringKey() allows OutOfMemoryError from an 8-byte payload (CVSS 7.5, FasterXML jackson-dataformat-protobuf)
- [CVE-2026-104895](https://cve.now/CVE-2026-104895.md): jackson-dataformat-smile: unbounded eager byte\[\] allocation for raw binary in the async parser allows OutOfMemoryError denial of service (CVSS 7.5, FasterXML jackson-dataformat-smile)
- [CVE-2026-106971](https://cve.now/CVE-2026-106971.md): An integer overflow in the MessagePack\\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a deni (no CVSS)
- [CVE-2026-106972](https://cve.now/CVE-2026-106972.md): Uncontrolled recursion in MessagePack\\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a… (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.