# CVEs published 2026-10-30

681 CVEs were published on October 30, 2026: 46 critical, 212 high. 5 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-fb31b3d414](https://cve.now/SZB-fb31b3d414): Applebee's fixes hardcoded-key flaw that reportedly exposed customer data
- [SZB-fd5da6a441](https://cve.now/SZB-fd5da6a441): Researcher reports Applebee's app exposed customer data via hardcoded database password
- [SZB-de02ba8ec3](https://cve.now/SZB-de02ba8ec3): Linux kernel MPTCP flaw reportedly allows remote root via exploit by Anthropic researchers
- [SZB-950a334ee6](https://cve.now/SZB-950a334ee6): Anthropic researchers report exploit for critical Linux kernel MPTCP flaw
- [SZB-06d1f3082a](https://cve.now/SZB-06d1f3082a): Resolve says hackers stole customer payment card data

## CVEs

- [CVE-2026-77152](https://cve.now/CVE-2026-77152.md): Field Collection for Drupal 7 access bypass via missing parent entity access check (CVSS 5.3, Field Collection for Drupal)
- [CVE-2026-117656](https://cve.now/CVE-2026-117656.md): Unverified Sign in with Apple callback parameter can override verified ID token claims (CVSS 9.3, pow-auth assent)
- [GHSA-4XM8-RG9H-JHQ2](https://cve.now/GHSA-4XM8-RG9H-JHQ2.md): Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution (critical (no CVSS), signalk-server · @signalk/resources-provider)
- [GHSA-HFF9-5PQW-6W9F](https://cve.now/GHSA-HFF9-5PQW-6W9F.md): imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution (critical (no CVSS), github.com/imgproxy/imgproxy/v3 · github.com/imgproxy/im… +1)
- [GHSA-494M-4556-WF5P](https://cve.now/GHSA-494M-4556-WF5P.md): imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash (high (no CVSS), github.com/imgproxy/imgproxy/v3)
- [GHSA-MMQ5-XM89-9PFG](https://cve.now/GHSA-MMQ5-XM89-9PFG.md): imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data\_size field (high (no CVSS), github.com/imgproxy/imgproxy/v3)
- [GHSA-2WRX-84QJ-4PCG](https://cve.now/GHSA-2WRX-84QJ-4PCG.md): anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS (medium (no CVSS), github.com/anacrolix/torrent)
- [CVE-2026-63414](https://cve.now/CVE-2026-63414.md): Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps (CVSS 7.6, shopify\_app)
- [CVE-2026-63410](https://cve.now/CVE-2026-63410.md): secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication (CVSS 5.9, sgbett secp256k1-native)
- [CVE-2026-63400](https://cve.now/CVE-2026-63400.md): Coop sessions are not invalidated on password reset (CVSS 2.3, roostorg coop)
- [CVE-2026-63398](https://cve.now/CVE-2026-63398.md): Coop has SAML cross-tenant authentication bypass (CVSS 7.4, roostorg coop)
- [CVE-2026-63401](https://cve.now/CVE-2026-63401.md): Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser (CVSS 5.3, roostorg coop)
- [CVE-2026-63396](https://cve.now/CVE-2026-63396.md): Coop has a data leak via unauthenticated GraphQL Query.allOrgs (CVSS 8.7, roostorg coop)
- [CVE-2026-63399](https://cve.now/CVE-2026-63399.md): Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg (CVSS 6.9, roostorg coop)
- [CVE-2026-63402](https://cve.now/CVE-2026-63402.md): i18next: Shared built-in corruption through inherited-key deepExtend recursion (CVSS 5.9, i18next)
- [CVE-2026-63339](https://cve.now/CVE-2026-63339.md): IXP Manager has authenticated non-administrator privilege escalation (CVSS 8.8, inex IXP-Manager)
- [CVE-2026-63338](https://cve.now/CVE-2026-63338.md): IXP Manager has Broken Object-Level Authorization (CVSS 8.3, inex IXP-Manager)
- [CVE-2026-63393](https://cve.now/CVE-2026-63393.md): OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution (CVSS 8.7, opensearch-project sql)
- [CVE-2026-63378](https://cve.now/CVE-2026-63378.md): TAKO AI Agent for Okta: Authenticated Python execution through validator bypass (CVSS 8.8, fctr-id okta-ai-agent)
- [CVE-2026-63377](https://cve.now/CVE-2026-63377.md): TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover (CVSS 9.8, fctr-id okta-ai-agent)
- [CVE-2026-63346](https://cve.now/CVE-2026-63346.md): Refitter: C# source injection through OpenAPI header parameter names (CVSS 8.6, christianhelle refitter)
- [CVE-2026-63344](https://cve.now/CVE-2026-63344.md): Refitter: C# source injection through OpenAPI content-type map keys (CVSS 8.6, christianhelle refitter)
- [CVE-2026-63345](https://cve.now/CVE-2026-63345.md): Refitter: C# source injection through OpenAPI path keys (CVSS 8.6, christianhelle refitter)
- [CVE-2026-61725](https://cve.now/CVE-2026-61725.md): sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites (CVSS 6.1, hasenbanck sevenz-rust2)
- [CVE-2026-63341](https://cve.now/CVE-2026-63341.md): Aedes has Uncaught Exception and Uncontrolled Resource Consumption (CVSS 7.5, moscajs aedes)
- [CVE-2026-63121](https://cve.now/CVE-2026-63121.md): Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules (CVSS 6.3, kubewarden policies)
- [CVE-2026-62277](https://cve.now/CVE-2026-62277.md): LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration (CVSS 6.5, hargata lubelog)
- [CVE-2026-63224](https://cve.now/CVE-2026-63224.md): OpenRemote has authenticated SQL injection in crosstab datapoint exports (CVSS 7.2, openremote · io.openremote:openremote-manager)
- [CVE-2026-63201](https://cve.now/CVE-2026-63201.md): netopeer2-server logging has format string vulnerability via subtree filter (CVSS 7.1, CESNET netopeer2)
- [CVE-2026-55614](https://cve.now/CVE-2026-55614.md): uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching (CVSS 6.9, openwrt uhttpd)
- [CVE-2026-55612](https://cve.now/CVE-2026-55612.md): uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset (CVSS 3.7, openwrt uhttpd)
- [CVE-2026-55613](https://cve.now/CVE-2026-55613.md): uhttpd: HTTP request smuggling via ubus POST body parse-error desync (CVSS 6.9, openwrt uhttpd)
- [CVE-2026-63184](https://cve.now/CVE-2026-63184.md): Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion (CVSS 7.1, christianhelle refitter)
- [CVE-2026-63182](https://cve.now/CVE-2026-63182.md): LightSAML: Signature reference wrapping permits unsigned assertion claims (CVSS 8.1, litesaml lightsaml)
- [CVE-2026-62347](https://cve.now/CVE-2026-62347.md): Element Call exposes shared passwords in logs (CVSS 5.9, element-hq element-call)
- [CVE-2026-63115](https://cve.now/CVE-2026-63115.md): ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts (CVSS 5.3, TryGhost ActivityPub)
- [CVE-2026-55146](https://cve.now/CVE-2026-55146.md): LORIS has incorrect access checks in issue\_tracker (CVSS 4.3, aces Loris)
- [CVE-2026-55147](https://cve.now/CVE-2026-55147.md): LORIS has incorrect access checks in API for Imaging Browser (CVSS 6.3, aces Loris)
- [CVE-2026-118938](https://cve.now/CVE-2026-118938.md): Fickling check\_safety() bypass: dotted qualname in STACK\_GLOBAL resolves a class-method attribute path that evades call analysis (CVSS 8.8, trailofbits fickling)
- [CVE-2026-111578](https://cve.now/CVE-2026-111578.md): PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields (CVSS 7.5, PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2026-16760](https://cve.now/CVE-2026-16760.md): Fickling check\_safety() bypass: likely\_safe\_imports grants module-origin trust to unvalidated standard library callables (CVSS 8.8, trailofbits fickling)
- [CVE-2026-62991](https://cve.now/CVE-2026-62991.md): Shopper: customer detail IDOR exposes administrator and staff records (CVSS 6.5, shopperlabs shopper)
- [CVE-2026-62990](https://cve.now/CVE-2026-62990.md): Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation (CVSS 8.7, shopperlabs shopper)
- [CVE-2026-62989](https://cve.now/CVE-2026-62989.md): Shopper: missing variant-delete authorization permits destructive single and bulk actions (CVSS 8.1, shopperlabs shopper)
- [CVE-2026-59993](https://cve.now/CVE-2026-59993.md): Picotls has NULL pointer dereference during handshake, when running as a client (CVSS 6.5, h2o picotls)
- [CVE-2026-62297](https://cve.now/CVE-2026-62297.md): ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS) (CVSS 7.5, Agamnentzar ag-psd)
- [CVE-2026-62979](https://cve.now/CVE-2026-62979.md): jack: upstream error responses expose backend and peer credentials (CVSS 8.4, roziscoding jack)
- [CVE-2026-62967](https://cve.now/CVE-2026-62967.md): ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser (CVSS 8.1, sinamics ztnet)
- [CVE-2026-62966](https://cve.now/CVE-2026-62966.md): ESPAsyncWebServer multipart parser has null-pointer write (CVSS 7.5, ESP32Async ESPAsyncWebServer)
- [CVE-2026-62965](https://cve.now/CVE-2026-62965.md): SABnzbd: Orphan-job path traversal permits arbitrary file deletion (CVSS 7.0, sabnzbd)
- [CVE-2026-62958](https://cve.now/CVE-2026-62958.md): libriscv: Out of bounds read vuln in the ELF parser (Denial of service) (CVSS 7.9, libriscv)
- [CVE-2026-62968](https://cve.now/CVE-2026-62968.md): Dream Displays has command-line argument injection in yt-dlp invocation (CVSS 8.7, arsmotorin dreamdisplays)
- [CVE-2026-62860](https://cve.now/CVE-2026-62860.md): Picsou vulnerable to login timing attack (CVSS 5.3, Zoeille picsou-finance)
- [CVE-2026-54610](https://cve.now/CVE-2026-54610.md): LibreDWG: const-input mutation and crash in bit\_TV\_to\_utf8 error handling (CVSS 3.3, libredwg)
- [CVE-2026-62250](https://cve.now/CVE-2026-62250.md): LibreDWG: unbounded allocation in pre-R13 DWG entity decoding (CVSS 5.5, libredwg)
- [CVE-2026-62254](https://cve.now/CVE-2026-62254.md): LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing (CVSS 5.5, libredwg)
- [CVE-2026-62864](https://cve.now/CVE-2026-62864.md): Ring's nested-params middleware has inefficient regular expression complexity (CVSS 7.5, ring-clojure ring)
- [CVE-2026-62863](https://cve.now/CVE-2026-62863.md): MoLing: unauthenticated SSE and wildcard CORS expose tool sessions (CVSS 9.6, gojue moling)
- [CVE-2026-119343](https://cve.now/CVE-2026-119343.md): Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read (CVSS 6.8, Stirling-Tools Stirling-PDF)
- [CVE-2026-40573](https://cve.now/CVE-2026-40573.md): NovumOS: Nova Interpreter Privilege Escalation (CVSS 8.6, MinecAnton209 NovumOS)
- [CVE-2026-62849](https://cve.now/CVE-2026-62849.md): ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection (CVSS 9.1, mqttsnet thinglinks)
- [CVE-2026-119342](https://cve.now/CVE-2026-119342.md): Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass (CVSS 5.3, Stirling-Tools Stirling-PDF)
- [CVE-2026-62853](https://cve.now/CVE-2026-62853.md): ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks (CVSS 9.9, mqttsnet thinglinks)
- [CVE-2026-117645](https://cve.now/CVE-2026-117645.md): Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes\_escape/1 (CVSS 5.3, phoenixframework phoenix\_html)
- [CVE-2026-119341](https://cve.now/CVE-2026-119341.md): Tesseract: File-controlled pointers still reach \`delete\` in ADAPT\_CLASS\_STRUCT destructor (CVSS 0.0, tesseract-ocr tesseract)
- [CVE-2026-62847](https://cve.now/CVE-2026-62847.md): Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS) (CVSS 8.2, Metalama)
- [CVE-2026-119340](https://cve.now/CVE-2026-119340.md): Tesseract: GENERIC\_2D\_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions (CVSS 5.5, tesseract-ocr tesseract)
- [CVE-2026-117666](https://cve.now/CVE-2026-117666.md): ssl\_verify\_fun: partial-label wildcard certificate matches hostnames across a label boundary (CVSS 9.1, deadtrickster ssl\_verify\_fun)
- [CVE-2026-62848](https://cve.now/CVE-2026-62848.md): Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution (CVSS 7.3, Metalama)
- [CVE-2026-62300](https://cve.now/CVE-2026-62300.md): Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources (CVSS 6.5, filecoin-project filecoin-pin)
- [CVE-2026-119339](https://cve.now/CVE-2026-119339.md): Tesseract: Crafted LSTM model (\`WeightMatrix\` mode byte) triggers \`ASSERT\_HOST\` abort in \`WeightMatrix::DeSerializeOld\` under \`FAST\_FLOAT\`… (CVSS 5.5, tesseract-ocr tesseract)
- [CVE-2026-58412](https://cve.now/CVE-2026-58412.md): Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow (CVSS 8.2, filecoin-project filecoin-pin)
- [CVE-2026-119338](https://cve.now/CVE-2026-119338.md): Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages (CVSS 6.9, tesseract-ocr tesseract)
- [CVE-2026-119337](https://cve.now/CVE-2026-119337.md): RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization (CVSS 7.1, infiniflow ragflow)
- [CVE-2026-55098](https://cve.now/CVE-2026-55098.md): Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 (CVSS 6.5, Basekick-Labs arc)
- [CVE-2026-62333](https://cve.now/CVE-2026-62333.md): OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots (CVSS 8.7, openvm-org openvm)
- [CVE-2026-62334](https://cve.now/CVE-2026-62334.md): OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification (CVSS 8.7, openvm-org openvm)
- [CVE-2026-119336](https://cve.now/CVE-2026-119336.md): Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink (CVSS 7.8, pi-hole)
- [CVE-2026-119335](https://cve.now/CVE-2026-119335.md): Pi-hole: Local privilege escalation from \`pihole\` user to root via CVE-2026-41489 fix bypass (CVSS 7.8, pi-hole)
- [CVE-2026-62335](https://cve.now/CVE-2026-62335.md): OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments (CVSS 6.9, openvm-org openvm)
- [CVE-2026-119334](https://cve.now/CVE-2026-119334.md): Pi-hole: file:// adlist read check and curl can resolve different files (CVSS 2.2, pi-hole)
- [CVE-2026-62337](https://cve.now/CVE-2026-62337.md): SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements (CVSS 6.9, axiom-crypto snark-verifier)
- [CVE-2026-119333](https://cve.now/CVE-2026-119333.md): draw.io Desktop allows Windows executable search-path hijacking (CVSS 7.8, jgraph drawio-desktop)
- [CVE-2026-61618](https://cve.now/CVE-2026-61618.md): SNARK Verifier: noncanonical accumulator limb decoding (CVSS 6.9, axiom-crypto snark-verifier)
- [CVE-2026-119332](https://cve.now/CVE-2026-119332.md): Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister() (CVSS 8.8, LadybirdBrowser ladybird)
- [CVE-2026-61620](https://cve.now/CVE-2026-61620.md): HoneySQL unchecked entity names can lead to SQL injection results (CVSS 9.8, seancorfield honeysql)
- [CVE-2026-119331](https://cve.now/CVE-2026-119331.md): Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation (CVSS 7.1, LadybirdBrowser ladybird)
- [CVE-2026-116252](https://cve.now/CVE-2026-116252.md): pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name (CVSS 6.5, pgadmin.org pgAdmin)
- [CVE-2026-116251](https://cve.now/CVE-2026-116251.md): pgAdmin 4: A user's other sessions survive a change of their password (CVSS 4.2, pgadmin.org pgAdmin)
- [CVE-2026-116250](https://cve.now/CVE-2026-116250.md): pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check (CVSS 6.5, pgadmin.org pgAdmin)
- [CVE-2026-116249](https://cve.now/CVE-2026-116249.md): pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory (CVSS 8.4, pgadmin.org pgAdmin)
- [CVE-2026-116248](https://cve.now/CVE-2026-116248.md): pgAdmin 4: Non-administrators can share a server with every user (CVSS 6.8, pgadmin.org pgAdmin)
- [CVE-2026-116247](https://cve.now/CVE-2026-116247.md): pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate (CVSS 8.2, pgadmin.org pgAdmin)
- [CVE-2026-116246](https://cve.now/CVE-2026-116246.md): pgAdmin 4: Server passwords are left in pgAdmin's process environment (CVSS 6.5, pgadmin.org pgAdmin)
- [CVE-2026-116245](https://cve.now/CVE-2026-116245.md): pgAdmin 4: Connection services are not restricted in server mode (CVSS 8.2, pgadmin.org pgAdmin)
- [CVE-2026-116244](https://cve.now/CVE-2026-116244.md): pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials (CVSS 8.2, pgadmin.org pgAdmin)
- [CVE-2026-116243](https://cve.now/CVE-2026-116243.md): pgAdmin 4: Utility binary path can point at a shared storage directory (CVSS 7.5, pgadmin.org pgAdmin)
- [CVE-2026-116242](https://cve.now/CVE-2026-116242.md): pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity (CVSS 8.2, pgadmin.org pgAdmin)
- [CVE-2026-116241](https://cve.now/CVE-2026-116241.md): pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier (CVSS 9.9, pgadmin.org pgAdmin)
- [CVE-2026-116240](https://cve.now/CVE-2026-116240.md): pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked (CVSS 6.5, pgadmin.org pgAdmin)
- [CVE-2026-116239](https://cve.now/CVE-2026-116239.md): pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username (CVSS 8.5, pgadmin.org pgAdmin)
- [CVE-2026-116238](https://cve.now/CVE-2026-116238.md): pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks (CVSS 8.1, pgadmin.org pgAdmin)
- [CVE-2026-61694](https://cve.now/CVE-2026-61694.md): go-xrpl: ParseMPTAmountBinary: positive MPT amount silently decoded as negative (int64 wrap) (CVSS 3.7, LeJamon go-xrpl)
- [CVE-2026-119330](https://cve.now/CVE-2026-119330.md): Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (CVSS 3.5, immich-app immich)
- [CVE-2026-119329](https://cve.now/CVE-2026-119329.md): Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (CVSS 4.3, immich-app immich)
- [CVE-2026-119328](https://cve.now/CVE-2026-119328.md): Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service (CVSS 6.5, immich-app immich)
- [CVE-2026-115829](https://cve.now/CVE-2026-115829.md): Secret Server partial login bypass (CVSS 8.7, Delinea Secret Server)
- [CVE-2026-115830](https://cve.now/CVE-2026-115830.md): Secret Server JWT issuance error (CVSS 8.7, Delinea Secret Server)
- [CVE-2026-115828](https://cve.now/CVE-2026-115828.md): Secret Server device validation error (CVSS 5.1, Delinea Secret Server)
- [CVE-2026-61850](https://cve.now/CVE-2026-61850.md): Kargo: Privilege escalation via Project RBAC management in the Kargo API (CVSS 9.3, akuity kargo)
- [CVE-2026-55598](https://cve.now/CVE-2026-55598.md): PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation) (CVSS 9.1, madeofpendletonwool PinePods)
- [CVE-2026-62302](https://cve.now/CVE-2026-62302.md): MyTube: Unauthenticated Media Access via Static Routes Bypassing Login (CVSS 8.7, franklioxygen MyTube)
- [CVE-2026-62301](https://cve.now/CVE-2026-62301.md): MyTube: Visitor Can Access Hidden Video Metadata and Content (CVSS 7.1, franklioxygen MyTube)
- [CVE-2026-55493](https://cve.now/CVE-2026-55493.md): HotCRP: comment-author search exposes anonymous commenter identities (CVSS 6.5, kohler hotcrp)
- [CVE-2026-62284](https://cve.now/CVE-2026-62284.md): OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy (CVSS 8.6, osac-project osac-operator)
- [CVE-2026-119730](https://cve.now/CVE-2026-119730.md): Maxthon Browser for Android \< 7.5.8.103 Fullscreen Address Bar Spoofing (CVSS 5.1, Maxthon Technology Limited Maxthon Browser for Android)
- [CVE-2026-78403](https://cve.now/CVE-2026-78403.md): Unauthenticated Stack Buffer Overflow in Sentinel Keys Server (CVSS 9.3, Thalesgroup Sentinel Keys Server)
- [CVE-2026-78402](https://cve.now/CVE-2026-78402.md): Stack Buffer Overflow in Sentinel Keys Server (CVSS 7.3, Thalesgroup Sentinel Keys Server)
- [CVE-2026-7005](https://cve.now/CVE-2026-7005.md): WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding (CVSS 5.3, WIT SynApps Runtime)
- [CVE-2026-62331](https://cve.now/CVE-2026-62331.md): praktor: Telegram upload traversal permits persistent agent instruction injection (CVSS 8.2, mtzanidakis praktor)
- [CVE-2026-7004](https://cve.now/CVE-2026-7004.md): WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter (CVSS 5.1, WIT SynApps Runtime)
- [CVE-2026-61586](https://cve.now/CVE-2026-61586.md): Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider) (CVSS 8.2, copernik-eu copernik-xml-factory)
- [CVE-2026-7003](https://cve.now/CVE-2026-7003.md): WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure (CVSS 6.9, WIT SynApps Runtime)
- [CVE-2026-62303](https://cve.now/CVE-2026-62303.md): Pistache: DoS via stack exhaustion in REST router path normalization (regex\_replace on long slash runs) (CVSS 5.9, pistacheio pistache)
- [CVE-2026-62298](https://cve.now/CVE-2026-62298.md): asn1c: ASAN crash with decode of open types (CVSS 0.0, mouse07410 asn1c)
- [CVE-2026-59978](https://cve.now/CVE-2026-59978.md): AdminNeo: version-cache array injection causes persistent denial of service (CVSS 7.5, adminneo-org adminneo · adminneo-org/adminneo)
- [CVE-2026-120046](https://cve.now/CVE-2026-120046.md): Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History (CVSS 6.0, nezhahq nezha)
- [CVE-2026-120007](https://cve.now/CVE-2026-120007.md): NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid (CVSS 6.9, NodeBB)
- [CVE-2026-119842](https://cve.now/CVE-2026-119842.md): Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-119727](https://cve.now/CVE-2026-119727.md): Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-61848](https://cve.now/CVE-2026-61848.md): Crass: Non-ASCII characters cause superlinear CPU consumption (CVSS 6.3, rgrove crass · crass)
- [CVE-2026-61847](https://cve.now/CVE-2026-61847.md): Crass: A large number of adjacent CSS comments can trigger a SystemStackError (CVSS 6.3, rgrove crass · crass)
- [CVE-2026-61846](https://cve.now/CVE-2026-61846.md): Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage (CVSS 6.3, rgrove crass · crass)
- [CVE-2026-61845](https://cve.now/CVE-2026-61845.md): Crass: Large numeric exponents cause CPU and memory denial of service (CVSS 8.9, rgrove crass)
- [CVE-2026-46560](https://cve.now/CVE-2026-46560.md): OpenAM Authentication Bypass via RADIUS Spoofing (CVSS 7.5, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-119729](https://cve.now/CVE-2026-119729.md): Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-119728](https://cve.now/CVE-2026-119728.md): Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-62264](https://cve.now/CVE-2026-62264.md): PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP\_API\_KEY (CVSS 7.5, SylphxAI pdf-reader-mcp · @sylphx/pdf-reader-mcp)
- [CVE-2026-118090](https://cve.now/CVE-2026-118090.md): WordPress MasterStudy LMS plugin \<= 3.7.55 - PHP Object Injection vulnerability (CVSS 8.8, Stylemix MasterStudy LMS)
- [CVE-2026-118089](https://cve.now/CVE-2026-118089.md): WordPress Product Feed Manager plugin \<= 7.14.1 - PHP Object Injection vulnerability (CVSS 7.2, RexTheme Product Feed Manager)
- [CVE-2026-118086](https://cve.now/CVE-2026-118086.md): WordPress WP BASE Booking plugin \<= 6.5.2 - Privilege Escalation vulnerability (CVSS 8.8, Hakan Ozevin WP BASE Booking)
- [CVE-2026-116862](https://cve.now/CVE-2026-116862.md): WordPress WP REST Cache plugin \<= 2026.3.1 - Broken Access Control vulnerability (CVSS 7.5, Acato WP REST Cache)
- [CVE-2026-116861](https://cve.now/CVE-2026-116861.md): WordPress Flexible Chat plugin \<= 1.1.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, wpdesk Flexible Chat)
- [CVE-2026-116854](https://cve.now/CVE-2026-116854.md): WordPress WP Customer Area plugin \<= 8.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aguila Technologies WP Customer Area)
- [CVE-2026-116853](https://cve.now/CVE-2026-116853.md): WordPress GiveWP plugin \<= 4.19.0.1 - Broken Access Control vulnerability (CVSS 6.5, Nexcess GiveWP)
- [CVE-2026-116852](https://cve.now/CVE-2026-116852.md): WordPress Widget Options plugin \<= 4.2.5 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Marketing Fire Widget Options)
- [CVE-2026-116851](https://cve.now/CVE-2026-116851.md): WordPress eCommerce Product Catalog plugin \<= 3.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, impleCode eCommerce Product Catalog)
- [CVE-2026-116847](https://cve.now/CVE-2026-116847.md): WordPress Mang Board WP plugin \<= 2.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kitae Park Mang Board WP)
- [CVE-2026-116410](https://cve.now/CVE-2026-116410.md): WordPress Masteriyo - LMS plugin \<= 3.4.3 - Arbitrary Content Deletion vulnerability (CVSS 6.5, Masteriyo - LMS)
- [CVE-2026-116405](https://cve.now/CVE-2026-116405.md): WordPress VikRentCar plugin \<= 1.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikRentCar)
- [CVE-2026-116401](https://cve.now/CVE-2026-116401.md): WordPress HUSKY plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 7.5, RealMag777 HUSKY)
- [CVE-2026-116386](https://cve.now/CVE-2026-116386.md): WordPress SMS Alert Order Notifications plugin \<= 4.0.2 - Privilege Escalation vulnerability (CVSS 9.8, Cozy Vision Technologies Pvt. SMS Alert Order Notifications)
- [CVE-2026-115947](https://cve.now/CVE-2026-115947.md): WordPress HUSKY plugin \<= 1.4.6 - Sensitive Data Exposure vulnerability (CVSS 6.5, RealMag777 HUSKY)
- [CVE-2026-115604](https://cve.now/CVE-2026-115604.md): WordPress SureDash plugin \<= 1.12.3 - Arbitrary File Deletion vulnerability (CVSS 5.0, Brainstorm Force SureDash)
- [CVE-2026-114711](https://cve.now/CVE-2026-114711.md): WordPress MultiVendorX plugin \<= 5.0.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MultiVendorX)
- [CVE-2026-107868](https://cve.now/CVE-2026-107868.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.34.0 - Bypass Vulnerability vulnerability (CVSS 5.3, YITHEMES YITH WooCommerce Product Add-Ons)
- [CVE-2026-105077](https://cve.now/CVE-2026-105077.md): WordPress Ad Inserter plugin \<= 2.8.19 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Spacetime Ad Inserter)
- [CVE-2026-94175](https://cve.now/CVE-2026-94175.md): WordPress All In One Login plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saad Iqbal All In One Login)
- [CVE-2026-90888](https://cve.now/CVE-2026-90888.md): WordPress LeadSnap plugin \<= 1.25 - PHP Object Injection vulnerability (CVSS 9.8, LeadSnap)
- [CVE-2026-78527](https://cve.now/CVE-2026-78527.md): WordPress GS Testimonial Slider plugin \<= 3.3.10 - PHP Object Injection vulnerability (CVSS 8.8, GS Plugins GS Testimonial Slider)
- [CVE-2026-73186](https://cve.now/CVE-2026-73186.md): WordPress Enable Media Replace plugin \<= 4.2.2 - PHP Object Injection vulnerability (CVSS 8.8, ShortPixel Enable Media Replace)
- [CVE-2026-54855](https://cve.now/CVE-2026-54855.md): WordPress Profile Builder plugin \<= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cozmoslabs Profile Builder)
- [CVE-2026-54854](https://cve.now/CVE-2026-54854.md): WordPress Profile Builder plugin \<= 4.0.5 - Privilege Escalation vulnerability (CVSS 6.3, Cozmoslabs Profile Builder)
- [CVE-2026-54850](https://cve.now/CVE-2026-54850.md): WordPress Booking and Rental Manager plugin \<= 2.8.2 - Broken Access Control vulnerability (CVSS 6.5, magepeopleteam Booking and Rental Manager)
- [CVE-2026-48201](https://cve.now/CVE-2026-48201.md): WordPress Fast Velocity Minify plugin \<= 3.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Raul P. Fast Velocity Minify)
- [CVE-2026-39786](https://cve.now/CVE-2026-39786.md): WordPress BA Book Everything plugin \<= 1.8.33 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bookingalgorithms BA Book Everything)
- [CVE-2026-39738](https://cve.now/CVE-2026-39738.md): WordPress FunnelKit Automations plugin \<= 3.8.6.1 - PHP Object Injection vulnerability (CVSS 9.8, FunnelKit Automations)
- [CVE-2026-39734](https://cve.now/CVE-2026-39734.md): WordPress WP EasyPay plugin \<= 4.5.4 - Path Traversal vulnerability (CVSS 7.5, Saad Iqbal WP EasyPay)
- [CVE-2026-39732](https://cve.now/CVE-2026-39732.md): WordPress Transliterator plugin \<= 2.5.13 - SQL Injection vulnerability (CVSS 9.3, Ivijan-Stefan Stipic Transliterator)
- [CVE-2026-28160](https://cve.now/CVE-2026-28160.md): WordPress VikRentCar plugin \<= 1.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikRentCar)
- [CVE-2026-27061](https://cve.now/CVE-2026-27061.md): WordPress User Registration plugin \<= 5.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpeverest User Registration)
- [CVE-2026-119526](https://cve.now/CVE-2026-119526.md): WordPress Royal Event theme \<= 2.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Royal Event)
- [CVE-2026-62162](https://cve.now/CVE-2026-62162.md): Hydra: Deposit Claim omits Head state-token spending requirement (CVSS 8.2, cardano-scaling hydra)
- [CVE-2026-62160](https://cve.now/CVE-2026-62160.md): Daptin: ParseAcceptLanguage \`\_\` separator bypass enables \>250x CPU amplification via Accept-Language header in LanguageMiddleware (CVSS 8.7, daptin · github.com/daptin/daptin)
- [CVE-2026-61854](https://cve.now/CVE-2026-61854.md): VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth (CVSS 8.2, jackh54 VoiceSentinel)
- [CVE-2026-61840](https://cve.now/CVE-2026-61840.md): Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services (CVSS 2.3, vantern-org questbot)
- [CVE-2026-62056](https://cve.now/CVE-2026-62056.md): WordPress Fluent CRM plugin \<= 3.2.6 - Broken Access Control vulnerability (CVSS 5.3, WP ManageNinja Fluent CRM)
- [CVE-2026-62023](https://cve.now/CVE-2026-62023.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.26 - Broken Access Control vulnerability (CVSS 4.3, Unlimited Elements For Elementor)
- [CVE-2026-62019](https://cve.now/CVE-2026-62019.md): WordPress BookIt plugin \<= 2.6.0.6 - Broken Access Control vulnerability (CVSS 4.3, Liquid Web / StellarWP BookIt)
- [CVE-2026-104674](https://cve.now/CVE-2026-104674.md): WordPress Booktics plugin \<= 1.0.31 - Broken Access Control vulnerability (CVSS 4.3, Arraytics Booktics)
- [CVE-2026-62047](https://cve.now/CVE-2026-62047.md): WordPress Event Tickets plugin \<= 5.30.2 - Broken Access Control vulnerability (CVSS 4.3, Liquid Web / StellarWP Event Tickets)
- [CVE-2026-39739](https://cve.now/CVE-2026-39739.md): WordPress Ultimate Addons for Elementor - Lite plugin \<= 2.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Ultimate Addons for Elementor - Lite)
- [CVE-2026-73322](https://cve.now/CVE-2026-73322.md): Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup() (no CVSS, Apache Software Foundation Apache Pinot)
- [CVE-2026-52710](https://cve.now/CVE-2026-52710.md): WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin \<= 4.5 - Content Injection vulnerability (CVSS 5.3, ithemelandco GIFTiT &#8211; Free Gifts for WooCommerce)
- [CVE-2026-62057](https://cve.now/CVE-2026-62057.md): WordPress Divi Contact Form 7 plugin \<= 4.1.0 - Content Injection vulnerability (CVSS 5.3, Fahim Reza Divi Contact Form)
- [CVE-2026-62121](https://cve.now/CVE-2026-62121.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.26 - Local File Inclusion vulnerability (CVSS 6.5, Unlimited Elements For Elementor)
- [CVE-2026-62122](https://cve.now/CVE-2026-62122.md): WordPress Booktics plugin \<= 1.0.31 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Booktics)
- [CVE-2026-119117](https://cve.now/CVE-2026-119117.md): Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java (CVSS 6.5, AWS amazon-kinesis-producer)
- [CVE-2026-119777](https://cve.now/CVE-2026-119777.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-119979](https://cve.now/CVE-2026-119979.md): LM Studio before 0.4.22+1 Path Traversal via Model Downloader (CVSS 8.7, Element Labs LM Studio)
- [CVE-2026-119620](https://cve.now/CVE-2026-119620.md): 37954679 cak-filemanagement-system add\_logs.php move\_uploaded\_file unrestricted upload (CVSS 6.9, 37954679 cak-filemanagement-system)
- [CVE-2026-84243](https://cve.now/CVE-2026-84243.md): gettext: Directory traversal via the LANGUAGE environment variable (CVSS 7.0, The GNU C Library glibc)
- [CVE-2026-119086](https://cve.now/CVE-2026-119086.md): Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel (CVSS 6.5, FreeRTOS-Kernel)
- [CVE-2026-118697](https://cve.now/CVE-2026-118697.md): In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised… (CVSS 9.0, JetBrains Toolbox App · JetBrains IntelliJ IDEA)
- [CVE-2026-118696](https://cve.now/CVE-2026-118696.md): In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before… (CVSS 8.0, JetBrains IntelliJ IDEA · JetBrains PyCharm +9)
- [CVE-2026-119978](https://cve.now/CVE-2026-119978.md): Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore (CVSS 9.0, FlowiseAI Flowise)
- [CVE-2026-69446](https://cve.now/CVE-2026-69446.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 4.4, Microsoft Edge)
- [CVE-2026-119764](https://cve.now/CVE-2026-119764.md): Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview (CVSS 7.4, its-a-feature Mythic)
- [CVE-2026-119763](https://cve.now/CVE-2026-119763.md): changelog.com before commit 7b35e829 Missing Authorization via Preview Routes (CVSS 6.9, thechangelog changelog.com)
- [CVE-2026-119762](https://cve.now/CVE-2026-119762.md): Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests (CVSS 8.7, Axigen Mail Server)
- [CVE-2026-119761](https://cve.now/CVE-2026-119761.md): Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name (CVSS 5.3, Axigen Mail Server)
- [CVE-2026-119760](https://cve.now/CVE-2026-119760.md): sniproxy through 0.7.0 NULL Pointer Dereference via resolv\_cancel() (CVSS 8.7, dlundquist sniproxy)
- [CVE-2026-76012](https://cve.now/CVE-2026-76012.md): Photo Gallery, Sliders, Proofing and Themes \<= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery\_edit' Task… (CVSS 7.5, smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…)
- [CVE-2026-119113](https://cve.now/CVE-2026-119113.md): GeoDirectory \<= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post\_content' Parameter (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-105894](https://cve.now/CVE-2026-105894.md): Ak Framework \<= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update (CVSS 8.8, akbilisim Ak Framework)
- [CVE-2026-115869](https://cve.now/CVE-2026-115869.md): Themify Builder \<= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field (CVSS 6.4, themifyme Themify Builder)
- [CVE-2026-109984](https://cve.now/CVE-2026-109984.md): FV Flowplayer Video Player \<= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments (CVSS 5.4, foliovision FV Flowplayer Video Player)
- [CVE-2026-104744](https://cve.now/CVE-2026-104744.md): Independent Analytics Pro \<= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm\_campaign' Parameter (CVSS 7.2, Independent Analytics Pro)
- [CVE-2026-112365](https://cve.now/CVE-2026-112365.md): easy.jobs \<= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover\_letter' Parameter (CVSS 7.2, wpdevteam easy.jobs – AI powered Job Listing, Job Board, Ca…)
- [CVE-2026-115346](https://cve.now/CVE-2026-115346.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field (CVSS 8.1, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2026-115820](https://cve.now/CVE-2026-115820.md): Majestic Support \<= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter (CVSS 6.5, ahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…)
- [CVE-2026-118205](https://cve.now/CVE-2026-118205.md): Essential Addons for Elementor \<= 6.8.7 - Unauthenticated Privilege Escalation to 'page\_id' Parameter via Elementor Revision (CVSS 7.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2026-109592](https://cve.now/CVE-2026-109592.md): OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin \<= 1.1.16 - Missing Authorization to Authenticated (Subscriber+)… (CVSS 4.3, wordpressdotorg OpenStation – Admin Dashboard Notes, Custom…)
- [CVE-2026-102918](https://cve.now/CVE-2026-102918.md): Redux Framework \<= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi\_media Field and Client-Supplied checkuser\_id (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-102905](https://cve.now/CVE-2026-102905.md): Ad Inserter \<= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter (CVSS 6.5, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2026-110533](https://cve.now/CVE-2026-110533.md): FV Flowplayer Video Player \<= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, foliovision FV Flowplayer Video Player)
- [CVE-2026-104739](https://cve.now/CVE-2026-104739.md): JS Help Desk \<= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support\_custom\_img' Parameter (CVSS 4.9, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2026-96894](https://cve.now/CVE-2026-96894.md): ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce \<= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email… (CVSS 7.2, wedevs ERP: Complete HR, Accounting & CRM Suite Built for W…)
- [CVE-2026-97638](https://cve.now/CVE-2026-97638.md): Forminator Forms \<= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via… (CVSS 7.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-118635](https://cve.now/CVE-2026-118635.md): GeoDirectory \<= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination\_info' Parameter (CVSS 6.5, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-107630](https://cve.now/CVE-2026-107630.md): Email Templates Customizer and Designer for WordPress and WooCommerce \<= 1.5.14 - Missing Authorization to Unauthenticated Order PII… (CVSS 7.5, saadiqbal Email Templates Customizer and Designer for WordP…)
- [CVE-2026-9239](https://cve.now/CVE-2026-9239.md): Meow Gallery \<= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) (CVSS 6.4, tigroumeow Meow Gallery)
- [CVE-2026-116552](https://cve.now/CVE-2026-116552.md): Like Button Rating ♥ LikeBtn \<= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header (CVSS 4.7, Like Button Rating ♥ LikeBtn)
- [CVE-2026-110305](https://cve.now/CVE-2026-110305.md): Advanced Custom Fields: Extended \<= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf\[\<mapped\_field\>\]' Parameter via… (CVSS 7.5, hwk-fr Advanced Custom Fields: Extended)
- [CVE-2026-110001](https://cve.now/CVE-2026-110001.md): FV Flowplayer Video Player \<= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute (CVSS 5.4, foliovision FV Flowplayer Video Player)
- [CVE-2025-8574](https://cve.now/CVE-2025-8574.md): Database Cleaner \<= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion (CVSS 8.7, tigroumeow Database Cleaner: Cleanup, Optimization & Repair)
- [CVE-2026-13747](https://cve.now/CVE-2026-13747.md): Meow Gallery \<= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch\_posts REST Endpoint (CVSS 6.5, tigroumeow Meow Gallery)
- [CVE-2026-119176](https://cve.now/CVE-2026-119176.md): CP Multi View Events Calendar \<= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter (CVSS 6.4, codepeople CP Multi View Events Calendar)
- [CVE-2026-119619](https://cve.now/CVE-2026-119619.md): 37954679 cak-filemanagement-system save\_student.php mysqli\_query sql injection (CVSS 6.9, 37954679 cak-filemanagement-system)
- [CVE-2026-61826](https://cve.now/CVE-2026-61826.md): Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request… (CVSS 10.0, morpheus65535 bazarr)
- [CVE-2026-50000](https://cve.now/CVE-2026-50000.md): SecureDrop: API session token reuse against the Journalist Interface web UI (CVSS 5.0, freedomofpress securedrop)
- [CVE-2026-61804](https://cve.now/CVE-2026-61804.md): myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management (CVSS 8.1, myTinyWMS)
- [CVE-2026-61806](https://cve.now/CVE-2026-61806.md): Frappe LMS allows unpublished certificate access (CVSS 5.3, frappe lms)
- [CVE-2026-61805](https://cve.now/CVE-2026-61805.md): Frappe LMS: Quiz result manipulation and cross-user submission forgery (CVSS 5.3, frappe lms)
- [CVE-2026-61803](https://cve.now/CVE-2026-61803.md): Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount (CVSS 5.3, frappe lms)
- [CVE-2026-55551](https://cve.now/CVE-2026-55551.md): ZAC: Missing per-zaaktype authorization on by-ID decision and process reads (CVSS 6.5, infonl dimpact-zaakafhandelcomponent)
- [CVE-2026-39375](https://cve.now/CVE-2026-39375.md): Frappe LMS has Stored XSS in Course Meta (CVSS 5.1, frappe lms)
- [CVE-2026-112816](https://cve.now/CVE-2026-112816.md): Improper certificate validation in the HTTPS listener in LXD (CVSS 10.0, Canonical LXD)
- [CVE-2026-119300](https://cve.now/CVE-2026-119300.md): Wekan: ReDoS via Unescaped User Input in RegExp (CVSS 6.5, wekan)
- [CVE-2026-119299](https://cve.now/CVE-2026-119299.md): gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments (CVSS 5.9, gopacket)
- [CVE-2026-115642](https://cve.now/CVE-2026-115642.md): In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an… (CVSS 8.3, OpenStack keystonemiddleware)
- [CVE-2026-119466](https://cve.now/CVE-2026-119466.md): WordPress APIExperts Square for WooCommerce plugin \<= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WPExperts APIExperts Square for WooCommerce)
- [CVE-2026-65566](https://cve.now/CVE-2026-65566.md): WordPress AI Engine plugin \<= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Meow Apps AI Engine)
- [CVE-2026-119298](https://cve.now/CVE-2026-119298.md): croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive (CVSS 4.2, schollz croc)
- [CVE-2026-119148](https://cve.now/CVE-2026-119148.md): Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint (CVSS 6.5, aws-nitro-enclaves-sdk-c)
- [CVE-2026-104623](https://cve.now/CVE-2026-104623.md): Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster (CVSS 6.3, SUSE Rancher)
- [CVE-2026-62055](https://cve.now/CVE-2026-62055.md): WordPress Event Tickets plugin \<= 5.30.2 - Broken Access Control vulnerability (CVSS 4.3, Liquid Web / StellarWP Event Tickets)
- [CVE-2026-119365](https://cve.now/CVE-2026-119365.md): WordPress Media Player Addons for Elementor – Media Player widget for WP plugin \<= 1.1.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Media Player Addons for Elementor – Media Player w…)
- [CVE-2026-119116](https://cve.now/CVE-2026-119116.md): Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c (CVSS 7.8, AWS kmstool-enclave)
- [CVE-2026-119367](https://cve.now/CVE-2026-119367.md): WordPress The Events Calendar plugin \<= 6.18.2 - Broken Access Control vulnerability (CVSS 5.4, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-61789](https://cve.now/CVE-2026-61789.md): DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation (CVSS 6.1, bytebase dbhub)
- [CVE-2026-119291](https://cve.now/CVE-2026-119291.md): zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory (CVSS 5.5, zuke-build zuke)
- [CVE-2026-119290](https://cve.now/CVE-2026-119290.md): Zuke: Resolved secret() values are written to GITHUB\_STEP\_SUMMARY in the clear, disclosing them to anyone who can view the workflow run (CVSS 7.5, zuke-build zuke)
- [CVE-2026-104615](https://cve.now/CVE-2026-104615.md): Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace (CVSS 7.9, SUSE Rancher)
- [CVE-2026-119289](https://cve.now/CVE-2026-119289.md): Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block… (CVSS 7.1, zuke-build zuke)
- [CVE-2026-119288](https://cve.now/CVE-2026-119288.md): Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line (CVSS 7.0, zuke-build zuke)
- [CVE-2026-119287](https://cve.now/CVE-2026-119287.md): Zuke: Command-form registry descriptors bypass the MCP launch policy (CVSS 8.0, zuke-build zuke)
- [CVE-2026-105454](https://cve.now/CVE-2026-105454.md): Stored XSS via crafted URLs in HTML ticket content in Request Tracker (CVSS 5.3, Best Practical Solutions Request Tracker)
- [CVE-2026-105455](https://cve.now/CVE-2026-105455.md): Stored XSS via related ticket subject on RTIR Split and Create Incident forms (CVSS 5.3, Best Practical Solutions RT for Incident Response)
- [CVE-2026-62141](https://cve.now/CVE-2026-62141.md): WordPress Fluent CRM plugin \<= 3.2.6 - Broken Access Control vulnerability (CVSS 5.4, WP ManageNinja Fluent CRM)
- [CVE-2026-105456](https://cve.now/CVE-2026-105456.md): Stored XSS via HTML scrubber rule in RTIR (CVSS 5.3, Best Practical Solutions RT for Incident Response)
- [CVE-2026-119722](https://cve.now/CVE-2026-119722.md): Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read\_struct() (CVSS 8.5, Blender Foundation Blender)
- [CVE-2026-119721](https://cve.now/CVE-2026-119721.md): Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo\_bhead\_id Accessors (CVSS 6.9, Blender Foundation Blender)
- [CVE-2026-119720](https://cve.now/CVE-2026-119720.md): Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block (CVSS 6.8, Blender Foundation Blender)
- [CVE-2026-119719](https://cve.now/CVE-2026-119719.md): Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction (CVSS 8.5, Blender Foundation Blender)
- [CVE-2026-119718](https://cve.now/CVE-2026-119718.md): Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache (CVSS 8.5, Blender Foundation Blender)
- [CVE-2026-119717](https://cve.now/CVE-2026-119717.md): pybars4 through 0.9.13 Code Injection via Bracketed Path Segments (CVSS 9.2, up9inc pybars4)
- [CVE-2026-119716](https://cve.now/CVE-2026-119716.md): pybars3 through 0.9.7 Code Injection via Bracketed Path Segments (CVSS 9.2, wbond pybars3)
- [CVE-2026-119715](https://cve.now/CVE-2026-119715.md): NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers (CVSS 5.3, nocodb)
- [CVE-2026-119714](https://cve.now/CVE-2026-119714.md): My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter (CVSS 6.9, joedolson My Calendar - Accessible Event Manager)
- [CVE-2026-119713](https://cve.now/CVE-2026-119713.md): Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands (CVSS 8.7, @paperclipai/server)
- [CVE-2026-119712](https://cve.now/CVE-2026-119712.md): PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents (CVSS 5.3, pipeshub-ai)
- [CVE-2026-119711](https://cve.now/CVE-2026-119711.md): PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header (CVSS 6.9, pipeshub-ai)
- [CVE-2026-119710](https://cve.now/CVE-2026-119710.md): PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route (CVSS 7.1, pipeshub-ai)
- [CVE-2026-119709](https://cve.now/CVE-2026-119709.md): Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata (CVSS 6.9, goniszewski grimoire)
- [CVE-2026-119708](https://cve.now/CVE-2026-119708.md): abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name (CVSS 7.1, colinin abp-next-admin)
- [CVE-2026-119707](https://cve.now/CVE-2026-119707.md): SonicJS through 3.0.0 Missing Authorization in Content Write API (CVSS 7.1, SonicJs-Org sonicjs)
- [CVE-2026-119706](https://cve.now/CVE-2026-119706.md): LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update\_weights Pickle Deserialization (CVSS 9.3, InternLM lmdeploy)
- [CVE-2026-119705](https://cve.now/CVE-2026-119705.md): SerpBear before 3.1.1 Missing Authentication via POST /api/notify (CVSS 6.9, towfiqi serpbear)
- [CVE-2026-119704](https://cve.now/CVE-2026-119704.md): Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp (CVSS 5.3, BastilleBSD bastille)
- [CVE-2026-119703](https://cve.now/CVE-2026-119703.md): xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header (CVSS 6.3, xinnan-tech xiaozhi-esp32-server)
- [CVE-2026-119702](https://cve.now/CVE-2026-119702.md): WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation (CVSS 6.9, WPGraphQL)
- [CVE-2026-119701](https://cve.now/CVE-2026-119701.md): WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations (CVSS 6.9, WPGraphQL)
- [CVE-2026-119700](https://cve.now/CVE-2026-119700.md): WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations (CVSS 6.9, WPGraphQL)
- [CVE-2026-119699](https://cve.now/CVE-2026-119699.md): WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS (CVSS 6.9, WPGraphQL Smart Cache)
- [CVE-2026-104067](https://cve.now/CVE-2026-104067.md): Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin (CVSS 8.5, Scribus)
- [CVE-2026-104066](https://cve.now/CVE-2026-104066.md): Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking (CVSS 8.5, Scribus)
- [CVE-2026-104065](https://cve.now/CVE-2026-104065.md): Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import (CVSS 8.5, Scribus)
- [CVE-2026-104064](https://cve.now/CVE-2026-104064.md): Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling (CVSS 8.5, Scribus)
- [CVE-2026-104063](https://cve.now/CVE-2026-104063.md): Scribus before 1.6.7 Out-of-Bounds Read via PICT Planar Image Data (CVSS 6.9, Scribus)
- [CVE-2026-104062](https://cve.now/CVE-2026-104062.md): Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Loader (CVSS 8.5, Scribus)
- [CVE-2026-104061](https://cve.now/CVE-2026-104061.md): Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader (CVSS 8.5, Scribus)
- [CVE-2026-119369](https://cve.now/CVE-2026-119369.md): WordPress The Events Calendar plugin \<= 6.18.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-119479](https://cve.now/CVE-2026-119479.md): WordPress JetFormBuilder plugin \<= 3.6.7.1 - Content Injection vulnerability (CVSS 5.3, Crocoblock JetFormBuilder)
- [CVE-2026-116407](https://cve.now/CVE-2026-116407.md): WordPress Webba Booking plugin \<= 6.5.4 - Broken Access Control vulnerability (CVSS 5.4, Webba Plugins Webba Booking)
- [CVE-2026-118238](https://cve.now/CVE-2026-118238.md): CVE-2026-118238 (CVSS 7.2, Tenda W18E)
- [CVE-2026-119368](https://cve.now/CVE-2026-119368.md): WordPress The Events Calendar plugin \<= 6.18.2 - Broken Access Control vulnerability (CVSS 5.3, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-119482](https://cve.now/CVE-2026-119482.md): WordPress JetFormBuilder plugin \<= 3.6.7.1 - Broken Access Control vulnerability (CVSS 5.3, Crocoblock JetFormBuilder)
- [CVE-2026-46499](https://cve.now/CVE-2026-46499.md): Collabora Online: Read-only session authorization bypass permits live document edits (CVSS 4.3, CollaboraOnline online)
- [CVE-2026-48164](https://cve.now/CVE-2026-48164.md): Collabora Online: Reflected HTML injection through host\_session\_id (CVSS 4.7, CollaboraOnline online)
- [CVE-2026-93327](https://cve.now/CVE-2026-93327.md): Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution (CVSS 9.4, Google Cloud Application Integration)
- [CVE-2026-61627](https://cve.now/CVE-2026-61627.md): libass: Out-of-bounds read and write in wrap\_lines\_measure (CVSS 7.3, libass)
- [GHSA-F3FJ-9625-RV3M](https://cve.now/GHSA-F3FJ-9625-RV3M.md): charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users (medium (no CVSS), github.com/charmbracelet/soft-serve)
- [CVE-2026-61626](https://cve.now/CVE-2026-61626.md): libass: Out-of-bounds bit clears for negative Matroska ReadOrder values (CVSS 7.3, libass)
- [CVE-2026-61739](https://cve.now/CVE-2026-61739.md): SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression) (CVSS 7.5, socfortress CoPilot)
- [GHSA-FGXM-5HVV-X4VH](https://cve.now/GHSA-FGXM-5HVV-X4VH.md): charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories (medium (no CVSS), github.com/charmbracelet/soft-serve)
- [CVE-2026-116860](https://cve.now/CVE-2026-116860.md): WordPress Timetics plugin \<= 1.0.65 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Timetics)
- [CVE-2026-119370](https://cve.now/CVE-2026-119370.md): WordPress The Events Calendar plugin \<= 6.18.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-65444](https://cve.now/CVE-2026-65444.md): WordPress Blocksy Companion plugin \<= 2.1.60 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Creative Themes Blocksy Companion)
- [CVE-2026-61738](https://cve.now/CVE-2026-61738.md): SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) (CVSS 10.0, socfortress CoPilot)
- [CVE-2026-61737](https://cve.now/CVE-2026-61737.md): ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin (CVSS 9.8, huajian123 ng-antd-admin)
- [CVE-2026-44344](https://cve.now/CVE-2026-44344.md): Chamilo LMS: Conditional PHP execution through vendored QuickForm eval (CVSS 6.6, chamilo-lms)
- [CVE-2026-45141](https://cve.now/CVE-2026-45141.md): Chamilo LMS: CSRF in destructive skill-management AJAX actions (CVSS 6.5, chamilo-lms)
- [CVE-2026-45145](https://cve.now/CVE-2026-45145.md): Chamilo LMS: Database-backed PHP object injection in career deserialization (CVSS 7.5, chamilo-lms)
- [CVE-2026-45144](https://cve.now/CVE-2026-45144.md): Chamilo LMS: Stored XSS in public user-profile fields (CVSS 8.9, chamilo-lms)
- [CVE-2026-61730](https://cve.now/CVE-2026-61730.md): SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount (CVSS 9.3, socfortress CoPilot)
- [CVE-2026-61729](https://cve.now/CVE-2026-61729.md): SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection (CVSS 9.4, socfortress CoPilot)
- [CVE-2015-20130](https://cve.now/CVE-2015-20130.md): Netsweeper \< 4.0.11 / 4.1.5 Reflected XSS via view\_server\_log.php (CVSS 5.1, Netsweeper)
- [CVE-2010-20125](https://cve.now/CVE-2010-20125.md): DedeCMS \< 5.7 File Inclusion via plus/carbuyaction.php (CVSS 8.7, DedeCMS)
- [CVE-2026-61728](https://cve.now/CVE-2026-61728.md): SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover (CVSS 9.9, socfortress CoPilot)
- [CVE-2026-111487](https://cve.now/CVE-2026-111487.md): Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework (CVSS 4.3, Qt Framework)
- [CVE-2026-119682](https://cve.now/CVE-2026-119682.md): Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus (CVSS 7.9, ManageEngine SharePoint Manager Plus)
- [CVE-2026-61708](https://cve.now/CVE-2026-61708.md): SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer\_user) (CVSS 8.5, socfortress CoPilot)
- [CVE-2026-112905](https://cve.now/CVE-2026-112905.md): Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft (CVSS 9.0, givanz Vvveb)
- [CVE-2026-110799](https://cve.now/CVE-2026-110799.md): Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover (CVSS 9.8, givanz Vvveb)
- [CVE-2026-119665](https://cve.now/CVE-2026-119665.md): WHartTest 2.2.0 through 2.8.1 Missing Authorization via task\_center Scheduled-Task APIs (CVSS 5.3, MGdaasLab WHartTest)
- [CVE-2026-119664](https://cve.now/CVE-2026-119664.md): Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update (CVSS 5.3, wannabespace tamery)
- [CVE-2026-119663](https://cve.now/CVE-2026-119663.md): Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create (CVSS 5.3, wannabespace tamery)
- [CVE-2026-119662](https://cve.now/CVE-2026-119662.md): Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend (CVSS 8.7, songloft-org songloft)
- [CVE-2026-119661](https://cve.now/CVE-2026-119661.md): ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries (CVSS 2.3, star7th ShowDoc)
- [CVE-2026-119660](https://cve.now/CVE-2026-119660.md): MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key (CVSS 9.3, yincongcyincong MuseBot)
- [CVE-2026-119659](https://cve.now/CVE-2026-119659.md): Blossom through 1.17.1 Authorization Bypass via Folder Endpoints (CVSS 5.3, blossom-editor Blossom)
- [CVE-2026-119658](https://cve.now/CVE-2026-119658.md): PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/\<domain\_name\>/update (CVSS 5.3, PowerDNS-Admin)
- [CVE-2026-119657](https://cve.now/CVE-2026-119657.md): FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations (CVSS 2.3, zyx0814 FilePress)
- [CVE-2026-119656](https://cve.now/CVE-2026-119656.md): CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList (CVSS 8.7, CoreUnion CoreShop)
- [CVE-2026-119655](https://cve.now/CVE-2026-119655.md): CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList (CVSS 8.7, CoreUnion CoreShop)
- [CVE-2026-119654](https://cve.now/CVE-2026-119654.md): DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization (CVSS 8.7, devlive-community DataCap)
- [CVE-2026-119653](https://cve.now/CVE-2026-119653.md): Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete\_path (CVSS 5.3, admpub nging)
- [CVE-2026-119652](https://cve.now/CVE-2026-119652.md): HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure (CVSS 5.3, HuLaSpark HuLa-Server)
- [CVE-2026-119651](https://cve.now/CVE-2026-119651.md): HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion (CVSS 5.3, HuLaSpark HuLa-Server)
- [CVE-2026-119650](https://cve.now/CVE-2026-119650.md): HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController (CVSS 5.3, HuLaSpark HuLa-Server)
- [CVE-2026-119649](https://cve.now/CVE-2026-119649.md): Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check (CVSS 7.1, OrchardCMS Orchard)
- [CVE-2026-119648](https://cve.now/CVE-2026-119648.md): BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail (CVSS 5.3, TencentBlueKing bk-cmdb)
- [CVE-2026-119647](https://cve.now/CVE-2026-119647.md): RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId} (CVSS 5.3, dromara RuoYi-Vue-Plus)
- [CVE-2026-119646](https://cve.now/CVE-2026-119646.md): Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API (CVSS 5.3, Open Web Analytics)
- [CVE-2026-119645](https://cve.now/CVE-2026-119645.md): ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc (CVSS 7.1, easysoft zentaopms)
- [CVE-2026-119644](https://cve.now/CVE-2026-119644.md): Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints (CVSS 5.3, blossom-editor Blossom)
- [CVE-2026-119680](https://cve.now/CVE-2026-119680.md): Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature (CVSS 8.5, ManageEngine SharePoint Manager Plus)
- [CVE-2026-100355](https://cve.now/CVE-2026-100355.md): Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard (CVSS 3.1, basecamp once-campfire)
- [CVE-2026-112348](https://cve.now/CVE-2026-112348.md): Kirki WordPress Plugin \< 6.2.5 reCAPTCHA Bypass via Missing Token (CVSS 6.9, Themeum Kirki)
- [CVE-2026-112347](https://cve.now/CVE-2026-112347.md): Kirki WordPress Plugin \< 6.4.1 Broken Object-Level Access Control via Page API (CVSS 7.2, Themeum Kirki)
- [CVE-2026-119542](https://cve.now/CVE-2026-119542.md): Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror (CVSS 4.3, Red Hat build of Apache Camel 4 for Quarkus · Red Hat Da… +2)
- [CVE-2026-91912](https://cve.now/CVE-2026-91912.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. (CVSS 7.3, Dell OpenManage Enterprise)
- [CVE-2026-119528](https://cve.now/CVE-2026-119528.md): Gimp: gimp: stack buffer overflow in psd image resource header loader (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-91913](https://cve.now/CVE-2026-91913.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS… (CVSS 8.8, Dell OpenManage Enterprise)
- [CVE-2026-111498](https://cve.now/CVE-2026-111498.md): OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. (CVSS 4.7, Dell OpenManage Enterprise)
- [CVE-2026-86715](https://cve.now/CVE-2026-86715.md): Clear Text Storage of Password in Crypttech's Vatos DLP (CVSS 7.1, Crypttech Crypto and Informatics Technologies Industry and…)
- [CVE-2026-111499](https://cve.now/CVE-2026-111499.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. (CVSS 5.5, Dell OpenManage Enterprise)
- [CVE-2026-91914](https://cve.now/CVE-2026-91914.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. (CVSS 7.1, Dell OpenManage Enterprise)
- [CVE-2026-111500](https://cve.now/CVE-2026-111500.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. (CVSS 5.4, Dell OpenManage Enterprise)
- [CVE-2026-115683](https://cve.now/CVE-2026-115683.md): epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler (CVSS 6.8, GNOME Epiphany)
- [CVE-2026-91915](https://cve.now/CVE-2026-91915.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a… (CVSS 6.8, Dell OpenManage Enterprise)
- [CVE-2026-119602](https://cve.now/CVE-2026-119602.md): libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window (CVSS 6.3, kyz libmspack)
- [CVE-2026-119601](https://cve.now/CVE-2026-119601.md): AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af\_get\_page (CVSS 6.9, sshock AFFLIB)
- [CVE-2026-119600](https://cve.now/CVE-2026-119600.md): tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length (CVSS 6.3, simsong tcpflow)
- [CVE-2026-119599](https://cve.now/CVE-2026-119599.md): AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes (CVSS 5.3, looplj AxonHub)
- [CVE-2026-119598](https://cve.now/CVE-2026-119598.md): Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external\_subscription\_id (CVSS 5.3, iluobei miaomiaowu)
- [CVE-2026-119597](https://cve.now/CVE-2026-119597.md): OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery (CVSS 9.3, AIDotNet OpenDeepWiki)
- [CVE-2026-119596](https://cve.now/CVE-2026-119596.md): UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download (CVSS 5.3, HDInnovations UNIT3D)
- [CVE-2026-119578](https://cve.now/CVE-2026-119578.md): MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo\_from\_json() (CVSS 8.5, Project-MONAI MONAI)
- [CVE-2026-119577](https://cve.now/CVE-2026-119577.md): ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections (CVSS 7.6, ArcadeData arcadedb)
- [CVE-2026-119576](https://cve.now/CVE-2026-119576.md): ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint (CVSS 5.3, ArcadeData arcadedb)
- [CVE-2026-119575](https://cve.now/CVE-2026-119575.md): ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List (CVSS 7.1, ArcadeData arcadedb)
- [CVE-2026-119574](https://cve.now/CVE-2026-119574.md): Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service (CVSS 8.2, traefik)
- [CVE-2026-119573](https://cve.now/CVE-2026-119573.md): Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret (CVSS 2.1, traefik)
- [CVE-2026-119572](https://cve.now/CVE-2026-119572.md): Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider (CVSS 7.0, traefik)
- [CVE-2026-119571](https://cve.now/CVE-2026-119571.md): Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID (CVSS 6.3, parse-community parse-server)
- [CVE-2026-119570](https://cve.now/CVE-2026-119570.md): Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses (CVSS 2.3, parse-community parse-server)
- [CVE-2026-119569](https://cve.now/CVE-2026-119569.md): Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service (CVSS 6.0, parse-community parse-server)
- [CVE-2026-118986](https://cve.now/CVE-2026-118986.md): CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand() (no CVSS, CallBackery)
- [CVE-2026-118987](https://cve.now/CVE-2026-118987.md): CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header (no CVSS, CallBackery)
- [CVE-2026-118990](https://cve.now/CVE-2026-118990.md): CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration… (no CVSS, CallBackery)
- [CVE-2026-118991](https://cve.now/CVE-2026-118991.md): CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key (no CVSS, CallBackery)
- [CVE-2026-118992](https://cve.now/CVE-2026-118992.md): CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup (CVSS 8.4, CallBackery)
- [CVE-2026-118993](https://cve.now/CVE-2026-118993.md): CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI… (no CVSS, CallBackery)
- [CVE-2026-118994](https://cve.now/CVE-2026-118994.md): CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name (no CVSS, CallBackery)
- [CVE-2026-118995](https://cve.now/CVE-2026-118995.md): CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator (no CVSS, CallBackery)
- [CVE-2026-118996](https://cve.now/CVE-2026-118996.md): CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig (no CVSS, CallBackery)
- [CVE-2026-13576](https://cve.now/CVE-2026-13576.md): CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes (no CVSS, CallBackery)
- [CVE-2026-119038](https://cve.now/CVE-2026-119038.md): Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect… (no CVSS, Business-GoCardless)
- [CVE-2026-119037](https://cve.now/CVE-2026-119037.md): Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty (no CVSS, Business-GoCardless)
- [CVE-2026-119036](https://cve.now/CVE-2026-119036.md): Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their… (no CVSS, Business-GoCardless)
- [CVE-2026-116128](https://cve.now/CVE-2026-116128.md): Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies (no CVSS, Starlet)
- [CVE-2026-116127](https://cve.now/CVE-2026-116127.md): Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined… (no CVSS, Starlet)
- [CVE-2026-115866](https://cve.now/CVE-2026-115866.md): Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request… (no CVSS, Starlet)
- [CVE-2026-115865](https://cve.now/CVE-2026-115865.md): Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory (no CVSS, Starlet)
- [CVE-2026-75882](https://cve.now/CVE-2026-75882.md): Improper access control vulnerability in ESET Encryption products for Windows (CVSS 8.5, ESET spol. s.r.o. ESET Endpoint Encryption · ESET spol. s.r…)
- [CVE-2026-116130](https://cve.now/CVE-2026-116130.md): HTTP::Parser::XS versions before 0.18 for Perl truncate PATH\_INFO at an encoded NUL byte in parse\_http\_request (no CVSS, HTTP-Parser-XS)
- [CVE-2026-118988](https://cve.now/CVE-2026-118988.md): CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route (no CVSS, CallBackery)
- [CVE-2026-87768](https://cve.now/CVE-2026-87768.md): DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds (no CVSS, DateTime-Lite)
- [CVE-2026-91917](https://cve.now/CVE-2026-91917.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. (CVSS 8.0, Dell OpenManage Enterprise)
- [CVE-2026-111501](https://cve.now/CVE-2026-111501.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. (CVSS 5.4, Dell OpenManage Enterprise)
- [CVE-2026-111502](https://cve.now/CVE-2026-111502.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. (CVSS 4.3, Dell OpenManage Enterprise)
- [CVE-2026-111503](https://cve.now/CVE-2026-111503.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL… (CVSS 7.1, Dell OpenManage Enterprise)
- [CVE-2026-112374](https://cve.now/CVE-2026-112374.md): FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API (CVSS 5.1, FOSSBilling)
- [CVE-2026-101209](https://cve.now/CVE-2026-101209.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. (CVSS 2.7, Dell OpenManage Enterprise)
- [CVE-2026-105924](https://cve.now/CVE-2026-105924.md): NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt (CVSS 4.3, Qt)
- [CVE-2026-111504](https://cve.now/CVE-2026-111504.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument… (CVSS 7.2, Dell OpenManage Enterprise)
- [RUSTSEC-2026-0425](https://cve.now/RUSTSEC-2026-0425.md): \`nix-nar\`: \`Decoder::unpack\` writes archive entries outside the destination directory (path traversal) (no CVSS, nix-nar)
- [RUSTSEC-2026-0426](https://cve.now/RUSTSEC-2026-0426.md): LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time (no CVSS, orion)
- [RUSTSEC-2026-0428](https://cve.now/RUSTSEC-2026-0428.md): BLAKE2b produces wrong tag when using \`reset()\` with a different-length key (no CVSS, orion)
- [CVE-2026-101210](https://cve.now/CVE-2026-101210.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS… (CVSS 7.2, Dell OpenManage Enterprise)
- [CVE-2026-110972](https://cve.now/CVE-2026-110972.md): Use of Client-Side Authentication in Płatnik (CVSS 8.6, Zakład Ubezpieczeń Społecznych Płatnik)
- [CVE-2026-110971](https://cve.now/CVE-2026-110971.md): Weak password encoding in Płatnik (CVSS 7.7, Zakład Ubezpieczeń Społecznych Płatnik)
- [CVE-2026-110970](https://cve.now/CVE-2026-110970.md): Lack of traffic encryption in Płatnik (CVSS 2.3, Zakład Ubezpieczeń Społecznych Płatnik)
- [CVE-2026-101213](https://cve.now/CVE-2026-101213.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. (CVSS 7.8, Dell OpenManage Enterprise)
- [CVE-2026-101214](https://cve.now/CVE-2026-101214.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS… (CVSS 7.2, Dell OpenManage Enterprise)
- [CVE-2026-111505](https://cve.now/CVE-2026-111505.md): Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS… (CVSS 8.8, Dell OpenManage Enterprise)
- [CVE-2025-68395](https://cve.now/CVE-2025-68395.md): Stored XSS in Protectel (CVSS 5.1, ARKETEAM PROTECTELMAJ · ARKETEAM BDF)
- [CVE-2025-68394](https://cve.now/CVE-2025-68394.md): SQL Injection in Protectel (CVSS 8.4, ARKETEAM PROTECTELMAJ · ARKETEAM BDF)
- [CVE-2025-68393](https://cve.now/CVE-2025-68393.md): SQL Injection in Protectel (CVSS 8.4, ARKETEAM PROTECTELMAJ · ARKETEAM BDF)
- [CVE-2025-68392](https://cve.now/CVE-2025-68392.md): Incorrect authorization in Protectel (CVSS 5.1, ARKETEAM PROTECTELMAJ · ARKETEAM BDF)
- [CVE-2025-68391](https://cve.now/CVE-2025-68391.md): Arbitrary File Upload in Protectel (CVSS 5.3, ARKETEAM PROTECTELMAJ · ARKETEAM BDF)
- [CVE-2026-119591](https://cve.now/CVE-2026-119591.md): SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause (CVSS 6.8, SQLite)
- [CVE-2026-119586](https://cve.now/CVE-2026-119586.md): SQLite CLI through 3.54.1 Command Injection via .recover Output (CVSS 8.5, SQLite)
- [CVE-2026-119568](https://cve.now/CVE-2026-119568.md): vsftpd through 3.0.5 require\_ssl\_reuse Bypass via FTPS Data Channel Hijacking (CVSS 9.1, vsftpd)
- [CVE-2026-119567](https://cve.now/CVE-2026-119567.md): vsftpd through 3.0.5 cmds\_denied Bypass via RFC 775 Command Aliases (CVSS 2.3, vsftpd)
- [CVE-2026-119566](https://cve.now/CVE-2026-119566.md): Prometheus through 3.15.1 Credential Leak via remote\_write Cross-Host Redirects (CVSS 6.3, prometheus)
- [CVE-2026-119565](https://cve.now/CVE-2026-119565.md): Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update (CVSS 5.3, Plausible Analytics)
- [CVE-2026-119564](https://cve.now/CVE-2026-119564.md): Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs (CVSS 6.0, Plausible Analytics)
- [CVE-2026-119563](https://cve.now/CVE-2026-119563.md): phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name (CVSS 5.1, phpMyAdmin)
- [CVE-2026-119562](https://cve.now/CVE-2026-119562.md): phpMyAdmin through 5.2.3 SQL Injection via Central Columns col\_extra and col\_attribute (CVSS 2.3, phpMyAdmin)
- [CVE-2026-119561](https://cve.now/CVE-2026-119561.md): phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer (CVSS 7.6, phpMyAdmin)
- [CVE-2026-119560](https://cve.now/CVE-2026-119560.md): OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields (CVSS 6.0, opnsense core)
- [CVE-2026-119559](https://cve.now/CVE-2026-119559.md): OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch (CVSS 8.2, litespeedtech openlitespeed)
- [CVE-2026-119558](https://cve.now/CVE-2026-119558.md): OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points (CVSS 2.3, OpenCart)
- [CVE-2026-119557](https://cve.now/CVE-2026-119557.md): n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node (CVSS 8.2, n8n-io n8n)
- [CVE-2026-119556](https://cve.now/CVE-2026-119556.md): Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core\_grades\_get\_gradeitems (CVSS 5.3, Moodle Project moodle)
- [CVE-2026-119555](https://cve.now/CVE-2026-119555.md): Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core\_grades\_get\_feedback (CVSS 5.3, Moodle Project moodle)
- [CVE-2026-119554](https://cve.now/CVE-2026-119554.md): Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol\_database Course idnumber (CVSS 6.0, Moodle Project moodle)
- [CVE-2026-119553](https://cve.now/CVE-2026-119553.md): Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal (CVSS 7.1, Moodle Project moodle)
- [CVE-2026-119552](https://cve.now/CVE-2026-119552.md): Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler (CVSS 6.3, louislam uptime-kuma)
- [CVE-2026-119551](https://cve.now/CVE-2026-119551.md): Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions (CVSS 7.1, jellyfin)
- [CVE-2026-119550](https://cve.now/CVE-2026-119550.md): Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId} (CVSS 5.1, jellyfin)
- [CVE-2026-119549](https://cve.now/CVE-2026-119549.md): Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images (CVSS 7.1, jellyfin)
- [CVE-2026-119548](https://cve.now/CVE-2026-119548.md): Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook (CVSS 2.3, getlago lago)
- [CVE-2026-119547](https://cve.now/CVE-2026-119547.md): Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} (CVSS 5.3, forgejo)
- [CVE-2026-119546](https://cve.now/CVE-2026-119546.md): Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo (CVSS 6.8, forgejo)
- [CVE-2026-119545](https://cve.now/CVE-2026-119545.md): Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery (CVSS 6.9, forgejo)
- [CVE-2026-119429](https://cve.now/CVE-2026-119429.md): phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set (CVSS 5.3, phpMyAdmin)
- [CVE-2026-119428](https://cve.now/CVE-2026-119428.md): phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled (CVSS 6.3, phpMyAdmin)
- [CVE-2026-119427](https://cve.now/CVE-2026-119427.md): phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting (CVSS 2.3, phpMyAdmin)
- [CVE-2026-119426](https://cve.now/CVE-2026-119426.md): phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql (CVSS 7.7, phpMyAdmin)
- [CVE-2026-119425](https://cve.now/CVE-2026-119425.md): OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP (CVSS 5.3, opnsense core)
- [CVE-2026-119424](https://cve.now/CVE-2026-119424.md): OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity (CVSS 6.1, opnsense core)
- [CVE-2026-119423](https://cve.now/CVE-2026-119423.md): OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username (CVSS 6.9, opnsense core)
- [CVE-2026-119422](https://cve.now/CVE-2026-119422.md): Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector (CVSS 8.2, juspay hyperswitch)
- [CVE-2026-119421](https://cve.now/CVE-2026-119421.md): Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation (CVSS 8.2, juspay hyperswitch)
- [CVE-2026-119420](https://cve.now/CVE-2026-119420.md): Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation (CVSS 8.7, getlago lago)
- [CVE-2026-119419](https://cve.now/CVE-2026-119419.md): CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation (CVSS 9.2, cakephp)
- [CVE-2026-119418](https://cve.now/CVE-2026-119418.md): CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() (CVSS 9.2, cakephp)
- [CVE-2026-119417](https://cve.now/CVE-2026-119417.md): CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport (CVSS 6.3, cakephp · cakephp/cakephp)
- [CVE-2026-119416](https://cve.now/CVE-2026-119416.md): CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching (CVSS 6.3, cakephp)
- [CVE-2026-119415](https://cve.now/CVE-2026-119415.md): CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type (CVSS 6.3, cakephp)
- [CVE-2026-119414](https://cve.now/CVE-2026-119414.md): Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create (CVSS 5.3, bitwarden server)
- [CVE-2026-119409](https://cve.now/CVE-2026-119409.md): OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting (CVSS 8.6, opnsense core)
- [CVE-2026-119408](https://cve.now/CVE-2026-119408.md): n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes (CVSS 8.7, n8n-io n8n)
- [CVE-2026-119407](https://cve.now/CVE-2026-119407.md): Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters (CVSS 7.1, element-hq element-web · element-hq element-desktop)
- [CVE-2026-119379](https://cve.now/CVE-2026-119379.md): SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind() (CVSS 8.5, SQLite)
- [CVE-2026-119378](https://cve.now/CVE-2026-119378.md): SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite() (CVSS 6.8, SQLite)
- [CVE-2026-119377](https://cve.now/CVE-2026-119377.md): SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING (CVSS 2.0, SQLite)
- [CVE-2026-119376](https://cve.now/CVE-2026-119376.md): SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain (CVSS 6.8, SQLite)
- [CVE-2026-119375](https://cve.now/CVE-2026-119375.md): SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch (CVSS 6.8, SQLite)
- [CVE-2026-119374](https://cve.now/CVE-2026-119374.md): SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete() (CVSS 8.5, SQLite)
- [CVE-2026-119373](https://cve.now/CVE-2026-119373.md): SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists() (CVSS 8.5, SQLite)
- [CVE-2026-119372](https://cve.now/CVE-2026-119372.md): SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet() (CVSS 6.8, SQLite)
- [CVE-2026-119371](https://cve.now/CVE-2026-119371.md): SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander() (CVSS 6.8, SQLite)
- [CVE-2026-119364](https://cve.now/CVE-2026-119364.md): ProFTPD through 1.3.9e and 1.3.10rc4 mod\_copy Symlink Following Write Bypass (CVSS 6.0, ProFTPD Project ProFTPD)
- [CVE-2026-119147](https://cve.now/CVE-2026-119147.md): ProFTPD before 1.3.9e and 1.3.10rc5 mod\_sftp Copy-File Authorization Bypass (CVSS 5.3, ProFTPD Project ProFTPD)
- [CVE-2026-119146](https://cve.now/CVE-2026-119146.md): ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod\_rewrite utf8trans RewriteMap (CVSS 6.3, ProFTPD Project ProFTPD)
- [CVE-2026-116366](https://cve.now/CVE-2026-116366.md): Unauthenticated RCE vulnerability against ClickHouse Server (CVSS 9.5, ClickHouse)
- [CVE-2026-22110](https://cve.now/CVE-2026-22110.md): Missing authentication check on POST/PUT requests (CVSS 8.7, Delta Electronics Delta UFC500)
- [CVE-2026-22105](https://cve.now/CVE-2026-22105.md): Use of default password based on serial number (CVSS 8.7, Delta Electronics Delta UFC500)
- [CVE-2026-22109](https://cve.now/CVE-2026-22109.md): Default WebUI passwords stored in plaintext (CVSS 8.4, Delta Electronics Delta UFC500)
- [CVE-2026-22114](https://cve.now/CVE-2026-22114.md): Missing brute-force protection for web interface (CVSS 5.3, Delta Electronics Delta UFC500)
- [CVE-2025-31704](https://cve.now/CVE-2025-31704.md): Dahua Intelligent Connection Center command injection (CVSS 9.8, Dahua Intelligent Connection Center)
- [CVE-2026-85268](https://cve.now/CVE-2026-85268.md): Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID (CVSS 8.7, Google Cloud Identity Platform and Firebase Authentication)
- [CVE-2026-14467](https://cve.now/CVE-2026-14467.md): Display of information in the Forocoches comments editor (CVSS 8.2, Forocoches comments editor)
- [CVE-2026-97209](https://cve.now/CVE-2026-97209.md): Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build (CVSS 5.4, elixir-lang elixir)
- [CVE-2026-115274](https://cve.now/CVE-2026-115274.md): Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir (CVSS 6.9, elixir-lang elixir)
- [CVE-2026-109821](https://cve.now/CVE-2026-109821.md): Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir (CVSS 6.3, elixir-lang elixir)
- [CVE-2026-59387](https://cve.now/CVE-2026-59387.md): Broken access control restriction in Cloud Controller API (CVSS 8.8, Cloud Foundry CAPI · Cloud Foundry cf-deployment)
- [CVE-2026-59385](https://cve.now/CVE-2026-59385.md): Space Developer can extract space-scoped broker credentials (CVSS 2.7, CAPI · Cloud Foundry CF Deployment)
- [CVE-2026-59388](https://cve.now/CVE-2026-59388.md): Cloud Controller exposes secrets in audit log (CVSS 6.5, Cloud Foundry Foundation CAPI · Cloud Foundry Foundation cf…)
- [CVE-2026-59386](https://cve.now/CVE-2026-59386.md): Credential exposure to space supporter (CVSS 6.5, Cloud Foundry Controller · Cloud Foundry cf-deployment)
- [CVE-2026-64618](https://cve.now/CVE-2026-64618.md): Apache Fineract: SQL injection vulnerability in Search API (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2026-59396](https://cve.now/CVE-2026-59396.md): DoS Vulnerability in UAA Related to JWKS URI Handling (CVSS 6.9, Cloud Foundry UAA · Cloud Foundry cf-deployment)
- [CVE-2026-115456](https://cve.now/CVE-2026-115456.md): Gcc: out-of-bounds read in std::from\_chars (CVSS 3.7, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-65874](https://cve.now/CVE-2026-65874.md): Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2026-82104](https://cve.now/CVE-2026-82104.md): API permission bypass via logic bug (CVSS 9.4, Teltonika Networks RUT · Teltonika Networks RUTX +12)
- [CVE-2026-115455](https://cve.now/CVE-2026-115455.md): Gcc: stack overflow in std::bitset on libstdc++ (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-114691](https://cve.now/CVE-2026-114691.md): Gcc: integer wrap in \`std (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-114690](https://cve.now/CVE-2026-114690.md): Gcc: confirmed out-of-bounds read/write in libstdc++ parallel \`std (CVSS 6.2, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-103039](https://cve.now/CVE-2026-103039.md): Gravity Forms \<= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field (CVSS 9.8, Gravity Forms)
- [CVE-2026-110732](https://cve.now/CVE-2026-110732.md): AI Engine – The Chatbot, AI Framework & MCP for WordPress \<= 3.8.6 - Missing Authorization to Administrator Account Takeover via… (CVSS 7.5, tigroumeow AI Engine – MCP Server & AI Chatbot for WordPres…)
- [CVE-2026-116622](https://cve.now/CVE-2026-116622.md): Food Store \<= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service\_time' Cookie (CVSS 7.2, wpscripts Food Store – Online Food Delivery & Pickup)
- [CVE-2026-97645](https://cve.now/CVE-2026-97645.md): Gravity Forms \<= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field (CVSS 7.2, Gravity Forms)
- [CVE-2026-89435](https://cve.now/CVE-2026-89435.md): Formidable Forms \<= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file\_url' Parameter (CVSS 8.8, strategy11team Formidable Forms – Contact Form, Survey, Qui…)
- [CVE-2026-90437](https://cve.now/CVE-2026-90437.md): Gravity Forms \<= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values (CVSS 7.2, Gravity Forms)
- [CVE-2026-118593](https://cve.now/CVE-2026-118593.md): Kernel: local\_bh imbalance in seg6\_input\_core() drop path (incomplete fix for cve-2026-46099) (CVSS 5.9, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-118952](https://cve.now/CVE-2026-118952.md): Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules (CVSS 6.5, Red Hat streams for Apache Kafka)
- [CVE-2026-118165](https://cve.now/CVE-2026-118165.md): Firelight Lightbox \< 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute (CVSS 6.8, Firelight Lightbox)
- [CVE-2026-118101](https://cve.now/CVE-2026-118101.md): BuddyForms \< 2.10.1 - Subscriber+ Arbitrary Post Modification (CVSS 5.3, BuddyForms)
- [CVE-2026-118100](https://cve.now/CVE-2026-118100.md): BuddyForms \< 2.10.3 - Unauthenticated Form Configuration Disclosure (CVSS 5.3, BuddyForms)
- [CVE-2026-118072](https://cve.now/CVE-2026-118072.md): Fraud Prevention For WooCommerce and EDD \< 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting (CVSS 5.4, Fraud Prevention For WooCommerce and EDD)
- [CVE-2026-118071](https://cve.now/CVE-2026-118071.md): Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute (CVSS 6.8, Joinchat)
- [CVE-2026-117572](https://cve.now/CVE-2026-117572.md): WP Visitor Statistics (Real Time Traffic) \< 8.8 - Admin+ SQLi via 'order' Parameter (CVSS 4.1, WP Visitor Statistics)
- [CVE-2026-117571](https://cve.now/CVE-2026-117571.md): WP Visitor Statistics (Real Time Traffic) \< 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters (CVSS 8.8, WP Visitor Statistics)
- [CVE-2026-115277](https://cve.now/CVE-2026-115277.md): WP User Frontend \< 4.3.14 - Reflected XSS via 'field\_attr' Parameter (CVSS 4.7, User Frontend)
- [CVE-2026-114444](https://cve.now/CVE-2026-114444.md): Security by CleanTalk \< 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer (CVSS 4.4, Security Plugin, Firewall & Malware Scanner with Auto Remov…)
- [CVE-2026-114443](https://cve.now/CVE-2026-114443.md): Security by CleanTalk \< 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code (CVSS 7.5, Security Plugin, Firewall & Malware Scanner with Auto Remov…)
- [CVE-2026-114422](https://cve.now/CVE-2026-114422.md): Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer (CVSS 7.5, Enable Media Replace)
- [CVE-2026-119087](https://cve.now/CVE-2026-119087.md): Content Egg \<= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset\_id' Parameter (CVSS 4.3, keywordrush Content Egg – Affiliate Product Importer & Pric…)
- [CVE-2026-119059](https://cve.now/CVE-2026-119059.md): Content Egg \<= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post\_id' Parameter via… (CVSS 4.3, keywordrush Content Egg – Affiliate Product Importer & Pric…)
- [CVE-2026-118634](https://cve.now/CVE-2026-118634.md): Events Made Easy \<= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute (CVSS 6.4, liedekef Events Made Easy)
- [CVE-2026-118500](https://cve.now/CVE-2026-118500.md): Cool FormKit Lite \<= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom\_id Parameter (CVSS 6.4, coolplugins Cool FormKit Lite – Advanced Form Builder for E…)
- [CVE-2026-118698](https://cve.now/CVE-2026-118698.md): JoomSport \<= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute (CVSS 6.5, beardev JoomSport – for Sports: Team & League, Football, Ho…)
- [CVE-2026-118194](https://cve.now/CVE-2026-118194.md): Page and Post Restriction \<= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication (CVSS 6.5, cyberlord92 Page and Post Restriction)
- [CVE-2026-5461](https://cve.now/CVE-2026-5461.md): Forminator Forms \<= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata (CVSS 6.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-104368](https://cve.now/CVE-2026-104368.md): Export and Import Users and Customers \<= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in… (CVSS 8.8, webtoffee Export and Import Users and Customers)
- [CVE-2026-103963](https://cve.now/CVE-2026-103963.md): Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-107249](https://cve.now/CVE-2026-107249.md): Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 (CVSS 9.8, Drupal Block AJAX)
- [CVE-2026-107250](https://cve.now/CVE-2026-107250.md): ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193 (CVSS 5.9, Drupal ECA Helper)
- [CVE-2026-107251](https://cve.now/CVE-2026-107251.md): Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194 (CVSS 6.5, Drupal Entity Reference Manager)
- [CVE-2026-107252](https://cve.now/CVE-2026-107252.md): MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195 (CVSS 5.4, MathJax: LaTeX for Drupal)
- [CVE-2026-107253](https://cve.now/CVE-2026-107253.md): Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196 (CVSS 5.9, Drupal Orphans Media)
- [CVE-2026-107254](https://cve.now/CVE-2026-107254.md): Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197 (CVSS 4.8, Drupal Authenticator Login Plus)
- [CVE-2026-107257](https://cve.now/CVE-2026-107257.md): Actstream - Critical - Access bypass - SA-CONTRIB-2026-198 (CVSS 6.5, Drupal Actstream)
- [CVE-2026-107258](https://cve.now/CVE-2026-107258.md): Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199 (CVSS 5.4, Drupal Inline Entity Form Dialog)
- [CVE-2026-107259](https://cve.now/CVE-2026-107259.md): Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200 (CVSS 5.4, Drupal Linked Field)
- [CVE-2026-107261](https://cve.now/CVE-2026-107261.md): Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201 (CVSS 4.2, Drupal Authenticator Login Plus)
- [CVE-2026-107263](https://cve.now/CVE-2026-107263.md): Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202 (CVSS 5.4, Drupal Gutenberg)
- [CVE-2026-107264](https://cve.now/CVE-2026-107264.md): Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203 (CVSS 5.4, Drupal Inline Formatter Field)
- [CVE-2026-107265](https://cve.now/CVE-2026-107265.md): Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204 (CVSS 5.4, Drupal Leaflet)
- [CVE-2026-107266](https://cve.now/CVE-2026-107266.md): Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205 (no CVSS, Drupal Views Share)
- [CVE-2026-96389](https://cve.now/CVE-2026-96389.md): Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206 (CVSS 6.5, Drupal Xray Audit)
- [CVE-2026-107268](https://cve.now/CVE-2026-107268.md): Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207 (CVSS 4.3, Drupal Two Factor Authentication - TFA / Passwordless Login)
- [CVE-2026-107267](https://cve.now/CVE-2026-107267.md): DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208 (CVSS 5.3, Drupal DKAN)
- [CVE-2026-107306](https://cve.now/CVE-2026-107306.md): Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209 (CVSS 3.8, Drupal Menu Link Attributes)
- [CVE-2026-107307](https://cve.now/CVE-2026-107307.md): SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210 (CVSS 4.3, Drupal SmartLinker AI)
- [CVE-2026-107308](https://cve.now/CVE-2026-107308.md): Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211 (CVSS 3.1, Drupal Country)
- [CVE-2026-107309](https://cve.now/CVE-2026-107309.md): Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212 (CVSS 3.7, Drupal Easy Breadcrumb)
- [CVE-2026-107310](https://cve.now/CVE-2026-107310.md): Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213 (CVSS 4.3, Drupal Freelinking)
- [CVE-2026-107311](https://cve.now/CVE-2026-107311.md): Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214 (CVSS 3.7, Drupal Permissions by Term)
- [CVE-2026-107312](https://cve.now/CVE-2026-107312.md): Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215 (CVSS 4.3, Drupal Examples for Developers)
- [CVE-2026-107255](https://cve.now/CVE-2026-107255.md): Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216 (no CVSS, Drupal Restrict route by IP)
- [CVE-2026-107262](https://cve.now/CVE-2026-107262.md): Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217 (CVSS 5.3, Drupal Advanced Filesystem)
- [CVE-2026-108097](https://cve.now/CVE-2026-108097.md): Drupal core - Critical - Remote code execution - SA-CORE-2026-014 (no CVSS, Drupal core)
- [CVE-2026-110738](https://cve.now/CVE-2026-110738.md): Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219 (no CVSS, Drupal Gin Admin Theme)
- [CVE-2026-108515](https://cve.now/CVE-2026-108515.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 (no CVSS, Drupal core)
- [CVE-2026-108514](https://cve.now/CVE-2026-108514.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 (no CVSS, Drupal core)
- [CVE-2026-108099](https://cve.now/CVE-2026-108099.md): Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 (no CVSS, Drupal Entity List)
- [CVE-2026-114523](https://cve.now/CVE-2026-114523.md): Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220 (no CVSS, Drupal Ffmpeg Image Toolkit)
- [CVE-2026-114527](https://cve.now/CVE-2026-114527.md): UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221 (no CVSS, Drupal UI Icons)
- [CVE-2026-114528](https://cve.now/CVE-2026-114528.md): Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222 (no CVSS, Drupal Zero Point)
- [CVE-2026-114526](https://cve.now/CVE-2026-114526.md): Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223 (no CVSS, Drupal Black Hole)
- [CVE-2026-114525](https://cve.now/CVE-2026-114525.md): ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224 (no CVSS, Drupal ABC)
- [CVE-2026-114524](https://cve.now/CVE-2026-114524.md): Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225 (no CVSS, Drupal Custom Formatters)
- [CVE-2026-114529](https://cve.now/CVE-2026-114529.md): CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226 (no CVSS, Drupal CSV Field)
- [CVE-2026-114530](https://cve.now/CVE-2026-114530.md): Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227 (no CVSS, Drupal Dopup)
- [CVE-2026-114531](https://cve.now/CVE-2026-114531.md): Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228 (no CVSS, Drupal Swiper formatter)
- [CVE-2026-107260](https://cve.now/CVE-2026-107260.md): Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229 (no CVSS, Drupal Sector Distribution)
- [CVE-2026-114532](https://cve.now/CVE-2026-114532.md): UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230 (no CVSS, Drupal UI Icons)
- [CVE-2026-114533](https://cve.now/CVE-2026-114533.md): Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231 (no CVSS, Drupal Ágora Transparency Theme)
- [CVE-2026-114534](https://cve.now/CVE-2026-114534.md): Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232 (no CVSS, Drupal Block Attributes)
- [CVE-2026-114535](https://cve.now/CVE-2026-114535.md): Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233 (no CVSS, Drupal Swiper formatter)
- [CVE-2026-114536](https://cve.now/CVE-2026-114536.md): USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234 (no CVSS, Drupal USWDS Paragraph Components)
- [CVE-2026-114537](https://cve.now/CVE-2026-114537.md): View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235 (no CVSS, Drupal View Unpublished)
- [CVE-2026-114538](https://cve.now/CVE-2026-114538.md): Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236 (no CVSS, Drupal Bootstrap)
- [CVE-2026-114539](https://cve.now/CVE-2026-114539.md): DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237 (no CVSS, Drupal DocCheck Basic)
- [CVE-2026-114540](https://cve.now/CVE-2026-114540.md): Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238 (no CVSS, Drupal Domain)
- [CVE-2026-114543](https://cve.now/CVE-2026-114543.md): Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239 (no CVSS, Drupal Simple User Management)
- [CVE-2026-114541](https://cve.now/CVE-2026-114541.md): Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240 (no CVSS, Drupal Frontend Editing)
- [CVE-2026-114553](https://cve.now/CVE-2026-114553.md): Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241 (no CVSS, Drupal Frontend Editing)
- [CVE-2026-114542](https://cve.now/CVE-2026-114542.md): Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 (no CVSS, Drupal Simple OAuth (OAuth2) & OpenID Connect · drupal/simp…)
- [CVE-2026-114544](https://cve.now/CVE-2026-114544.md): Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243 (no CVSS, Drupal Media Bulk Upload)
- [CVE-2026-114545](https://cve.now/CVE-2026-114545.md): Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244 (no CVSS, Drupal Fullcalendar View)
- [CVE-2026-114546](https://cve.now/CVE-2026-114546.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245 (no CVSS, Drupal Media Alias Display)
- [CVE-2026-114547](https://cve.now/CVE-2026-114547.md): TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246 (no CVSS, Drupal TinyPNG · drupal/tinypng)
- [CVE-2026-114548](https://cve.now/CVE-2026-114548.md): ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247 (no CVSS, Drupal ImageAPI Optimize WebP)
- [CVE-2026-107256](https://cve.now/CVE-2026-107256.md): Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248 (no CVSS, Drupal Shield)
- [CVE-2026-114572](https://cve.now/CVE-2026-114572.md): Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 (CVSS 5.4, Drupal Domain Login Restrict)
- [CVE-2026-114555](https://cve.now/CVE-2026-114555.md): Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250 (CVSS 3.5, Drupal Data field)
- [CVE-2026-114554](https://cve.now/CVE-2026-114554.md): AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251 (no CVSS, Drupal AI File to Text)
- [CVE-2026-114571](https://cve.now/CVE-2026-114571.md): Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252 (no CVSS, Drupal Rabbit Hole)
- [CVE-2026-114573](https://cve.now/CVE-2026-114573.md): Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 (no CVSS, Drupal Monster Menus)
- [CVE-2026-118539](https://cve.now/CVE-2026-118539.md): Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (CVSS 6.5, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118540](https://cve.now/CVE-2026-118540.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118541](https://cve.now/CVE-2026-118541.md): Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118542](https://cve.now/CVE-2026-118542.md): Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118543](https://cve.now/CVE-2026-118543.md): Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118544](https://cve.now/CVE-2026-118544.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118555](https://cve.now/CVE-2026-118555.md): Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 (no CVSS, Drupal Commerce License · drupal/commerce\_license)
- [CVE-2026-118556](https://cve.now/CVE-2026-118556.md): Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 (no CVSS, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118557](https://cve.now/CVE-2026-118557.md): Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 (no CVSS, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118558](https://cve.now/CVE-2026-118558.md): Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 (no CVSS, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118559](https://cve.now/CVE-2026-118559.md): Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 (no CVSS, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118560](https://cve.now/CVE-2026-118560.md): Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265 (no CVSS, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118545](https://cve.now/CVE-2026-118545.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118546](https://cve.now/CVE-2026-118546.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118548](https://cve.now/CVE-2026-118548.md): AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118549](https://cve.now/CVE-2026-118549.md): AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118550](https://cve.now/CVE-2026-118550.md): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118551](https://cve.now/CVE-2026-118551.md): AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118552](https://cve.now/CVE-2026-118552.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118553](https://cve.now/CVE-2026-118553.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118561](https://cve.now/CVE-2026-118561.md): Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 (no CVSS, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118562](https://cve.now/CVE-2026-118562.md): Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 (no CVSS, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118563](https://cve.now/CVE-2026-118563.md): CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276 (no CVSS, Drupal CacheFlush · drupal/cacheflush)
- [CVE-2026-118564](https://cve.now/CVE-2026-118564.md): PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277 (no CVSS, PayUmoney for Drupal Commerce · drupal/commerce\_payumoney)
- [CVE-2026-118565](https://cve.now/CVE-2026-118565.md): GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278 (no CVSS, Drupal GroupEx PRO ( Daxko ) integration · drupal/groupexp…)
- [CVE-2026-118582](https://cve.now/CVE-2026-118582.md): CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 (no CVSS, Drupal CAPTCHA · drupal/captcha)
- [CVE-2026-118569](https://cve.now/CVE-2026-118569.md): Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282 (no CVSS, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118570](https://cve.now/CVE-2026-118570.md): Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 (no CVSS, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118574](https://cve.now/CVE-2026-118574.md): S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 (no CVSS, Drupal S3 File System · drupal/s3fs)
- [CVE-2026-118567](https://cve.now/CVE-2026-118567.md): Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280 (no CVSS, Drupal Bulk Update User Roles · drupal/bulk\_update\_user\_rol…)
- [CVE-2026-118572](https://cve.now/CVE-2026-118572.md): OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 (no CVSS, Drupal OAuth Login - OAuth OIDC SSO · drupal/oauth\_login\_oa…)
- [CVE-2026-118575](https://cve.now/CVE-2026-118575.md): Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 (no CVSS, Drupal Signature pad widget · drupal/sign\_widget)
- [CVE-2026-118576](https://cve.now/CVE-2026-118576.md): Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 (no CVSS, Drupal Stage File Proxy · drupal/stage\_file\_proxy)
- [CVE-2026-118554](https://cve.now/CVE-2026-118554.md): OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 (no CVSS, Drupal OpenID Connect Client · drupal/oidc)
- [CVE-2026-118583](https://cve.now/CVE-2026-118583.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 (no CVSS, Drupal Field Permissions · drupal/field\_permissions)
- [CVE-2026-118584](https://cve.now/CVE-2026-118584.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 (no CVSS, Drupal Field Permissions · drupal/field\_permissions)
- [CVE-2026-118573](https://cve.now/CVE-2026-118573.md): OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 (no CVSS, Drupal OAuth2 Token Manager · drupal/oauth2\_token\_manager)
- [CVE-2026-118568](https://cve.now/CVE-2026-118568.md): Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291 (no CVSS, Drupal Content Sync · drupal/cms\_content\_sync)
- [CVE-2026-118571](https://cve.now/CVE-2026-118571.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292 (no CVSS, Drupal Media Alias Display · drupal/media\_alias\_display)
- [CVE-2026-74915](https://cve.now/CVE-2026-74915.md): GPU DDK - OOB write in UntwiddlePOTSquare64bpp (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-74912](https://cve.now/CVE-2026-74912.md): GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers \> 4GB (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-19199](https://cve.now/CVE-2026-19199.md): GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-18629](https://cve.now/CVE-2026-18629.md): GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-65587](https://cve.now/CVE-2026-65587.md): GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE\_BASE\_LEVEL change (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-65586](https://cve.now/CVE-2026-65586.md): GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-65584](https://cve.now/CVE-2026-65584.md): GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-118475](https://cve.now/CVE-2026-118475.md): Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk (CVSS 3.6, Red Hat Enterprise Linux)
- [CVE-2026-112922](https://cve.now/CVE-2026-112922.md): Ghostscript: out-of-bounds read in ghostscript shade\_next\_color via integer overflow of indexed color index in mesh shading (CVSS 3.3, Red Hat Enterprise Linux)
- [CVE-2026-15466](https://cve.now/CVE-2026-15466.md): GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM() (no CVSS, Imagination Technologies Graphics DDK)
- [CVE-2026-91920](https://cve.now/CVE-2026-91920.md): Undertow: undertow: chunkreader message length permits chunk-size overflow (CVSS 6.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +3)
- [CVE-2026-112605](https://cve.now/CVE-2026-112605.md): This issue was addressed with improved handling of symlinks. (no CVSS, Apple Xcode)
- [CVE-2026-112602](https://cve.now/CVE-2026-112602.md): An authorization issue was addressed with improved state management. (no CVSS, Apple Xcode)
- [CVE-2026-110133](https://cve.now/CVE-2026-110133.md): Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback (CVSS 5.8, Red Hat Enterprise Linux)
- [CVE-2026-118959](https://cve.now/CVE-2026-118959.md): Keycloak-services: keycloak-services: required actions bypassed via kc\_action parameter (CVSS 5.4, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-118947](https://cve.now/CVE-2026-118947.md): Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor (CVSS 4.3, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-119272](https://cve.now/CVE-2026-119272.md): Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-119271](https://cve.now/CVE-2026-119271.md): Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-119270](https://cve.now/CVE-2026-119270.md): Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute… (CVSS 8.8, Google Chrome)
- [CVE-2026-119269](https://cve.now/CVE-2026-119269.md): Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-119268](https://cve.now/CVE-2026-119268.md): Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside… (CVSS 8.8, Google Chrome)
- [CVE-2026-119267](https://cve.now/CVE-2026-119267.md): Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside… (CVSS 8.8, Google Chrome)
- [CVE-2026-119266](https://cve.now/CVE-2026-119266.md): Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the… (CVSS 8.8, Google Chrome)
- [CVE-2026-119265](https://cve.now/CVE-2026-119265.md): Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside… (CVSS 8.8, Google Chrome)
- [CVE-2026-119264](https://cve.now/CVE-2026-119264.md): Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside… (CVSS 8.8, Google Chrome)
- [CVE-2026-119263](https://cve.now/CVE-2026-119263.md): Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary… (CVSS 9.6, Google Chrome)
- [CVE-2026-119262](https://cve.now/CVE-2026-119262.md): Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code… (CVSS 8.8, Google Chrome)
- [CVE-2026-119261](https://cve.now/CVE-2026-119261.md): Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code… (CVSS 9.6, Google Chrome)
- [CVE-2026-119260](https://cve.now/CVE-2026-119260.md): Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox… (CVSS 8.8, Google Chrome)
- [CVE-2026-76031](https://cve.now/CVE-2026-76031.md): Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-76030](https://cve.now/CVE-2026-76030.md): Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code… (CVSS 8.8, Google Chrome)
- [CVE-2026-76029](https://cve.now/CVE-2026-76029.md): Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code… (CVSS 8.8, Google Chrome)
- [CVE-2026-76028](https://cve.now/CVE-2026-76028.md): Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the… (CVSS 8.8, Google Chrome)
- [CVE-2026-76027](https://cve.now/CVE-2026-76027.md): Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page. (CVSS 4.3, Google Chrome)
- [CVE-2026-76026](https://cve.now/CVE-2026-76026.md): Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the… (CVSS 8.8, Google Chrome)
- [CVE-2026-76025](https://cve.now/CVE-2026-76025.md): Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the… (CVSS 8.8, Google Chrome)
- [CVE-2026-76024](https://cve.now/CVE-2026-76024.md): Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the… (CVSS 6.5, Google Chrome)
- [CVE-2025-49602](https://cve.now/CVE-2025-49602.md): An issue was discovered in Keyfactor EJBCA 9. (no CVSS)
- [CVE-2026-117028](https://cve.now/CVE-2026-117028.md): Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. (no CVSS)
- [CVE-2026-117182](https://cve.now/CVE-2026-117182.md): An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to… (no CVSS)
- [CVE-2026-117183](https://cve.now/CVE-2026-117183.md): A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended… (no CVSS)
- [CVE-2026-117184](https://cve.now/CVE-2026-117184.md): An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to… (no CVSS)
- [CVE-2026-117346](https://cve.now/CVE-2026-117346.md): Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit (no CVSS)
- [CVE-2026-117349](https://cve.now/CVE-2026-117349.md): Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. (no CVSS)
- [CVE-2026-117350](https://cve.now/CVE-2026-117350.md): Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue. (no CVSS)
- [CVE-2026-37468](https://cve.now/CVE-2026-37468.md): Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the… (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.