# CVEs published 2026-11-04

368 CVEs were published on November 4, 2026: 41 critical, 147 high. 10 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-1923e002d8](https://cve.now/SZB-1923e002d8): BleepingComputer reports attackers compromised cPGuard update infrastructure
- [SZB-0c039a1b5c](https://cve.now/SZB-0c039a1b5c): WorkOS reports data breach exposing business contacts and communication summaries
- [SZB-4f5cab3822](https://cve.now/SZB-4f5cab3822): Zyxel patches zero-day exploited to hack nearly 1,000 GS1900 switches
- [SZB-6be53914c8](https://cve.now/SZB-6be53914c8): SonicWall says it will not patch two end-of-life GMS flaws, one rated CVSS 9.1
- [SZB-a2c9a50c66](https://cve.now/SZB-a2c9a50c66): Barracuda Networks warns customers to patch two vulnerabilities enabling root command execution
- [SZB-f4b7ff866c](https://cve.now/SZB-f4b7ff866c): Plerdy SEO Tracker reportedly used in APT29-linked iOS and Android watering hole campaign
- [SZB-2765c964a0](https://cve.now/SZB-2765c964a0): SecurityWeek reports Barracuda ESG auth bypass and command injection can chain to root
- [SZB-b785d96740](https://cve.now/SZB-b785d96740): Cyberattack reportedly wipes Beget cloud data and disrupts hundreds of sites
- [SZB-f42da64959](https://cve.now/SZB-f42da64959): Ivanti patches two more Connect Secure flaws exploited as zero-days since October 1
- [SZB-76a2041c5e](https://cve.now/SZB-76a2041c5e): Google patches critical Android flaw CVE-2026-58868 allowing remote code execution

## CVEs

- [CVE-2026-122051](https://cve.now/CVE-2026-122051.md): Edimax BR-6208AC mp command injection (CVSS 10.0, Edimax BR-6208AC)
- [CVE-2026-122050](https://cve.now/CVE-2026-122050.md): Campcodes Complete Sales and Inventory System with Credit Management login.php sql injection (CVSS 6.9, Campcodes Complete Sales and Inventory System with Credit M…)
- [CVE-2026-122049](https://cve.now/CVE-2026-122049.md): Campcodes Bitcoin Wallet System ForgotPasswordController.php random\_int excessive authentication (CVSS 6.3, Campcodes Bitcoin Wallet System)
- [CVE-2026-122048](https://cve.now/CVE-2026-122048.md): Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection (CVSS 6.9, Campcodes Division Regional Athletic Meet Game Result Matri…)
- [CVE-2026-122299](https://cve.now/CVE-2026-122299.md): Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation (CVSS 8.6, jelmer dulwich)
- [CVE-2026-102337](https://cve.now/CVE-2026-102337.md): Webmin: SSRF exploit in Upload and Download and File Manager modules (CVSS 4.9, webmin)
- [CVE-2026-77372](https://cve.now/CVE-2026-77372.md): VeraCrypt: Heap overflow and out-of-bounds read in Serializable deserialization (elevated Core service input path) (CVSS 8.8, VeraCrypt)
- [CVE-2026-97702](https://cve.now/CVE-2026-97702.md): Open edX: Support "manage\_course\_team" REST API omits the \`require\_support\_permission\` gate its sibling support views enforce (CVSS 5.3, openedx-platform)
- [CVE-2026-62365](https://cve.now/CVE-2026-62365.md): Wazuh: Heap Buffer Overflow in DecodeWinevt() join\_data Accumulation via Crafted EventChannel XML (CVSS 5.3, wazuh)
- [CVE-2026-122047](https://cve.now/CVE-2026-122047.md): Campcodes Complete Advance Loan Management System banner.php move\_uploaded\_file unrestricted upload (CVSS 6.9, Campcodes Complete Advance Loan Management System)
- [CVE-2026-115770](https://cve.now/CVE-2026-115770.md): Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing (CVSS 9.6, pocket-id)
- [CVE-2026-122038](https://cve.now/CVE-2026-122038.md): krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql\_query sql injection (CVSS 6.9, krupalshah EmployeeRecruitmentSystem)
- [CVE-2026-62662](https://cve.now/CVE-2026-62662.md): Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences (CVSS 7.7, pocket-id)
- [CVE-2026-108387](https://cve.now/CVE-2026-108387.md): radare2: Remote code execution when loading Pebble/SMD binary (CVSS 8.5, radareorg radare2)
- [CVE-2026-53631](https://cve.now/CVE-2026-53631.md): GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds (CVSS 5.3, glpi-project glpi)
- [CVE-2026-47678](https://cve.now/CVE-2026-47678.md): GLPI: Blind Time based SQLI in dropdowns (CVSS 8.7, glpi-project glpi)
- [CVE-2026-54384](https://cve.now/CVE-2026-54384.md): VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ (CVSS 9.3, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-52848](https://cve.now/CVE-2026-52848.md): GLPI: MFA bypass (CVSS 9.2, glpi-project glpi)
- [CVE-2026-54383](https://cve.now/CVE-2026-54383.md): VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint (CVSS 7.1, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-57152](https://cve.now/CVE-2026-57152.md): GLPI: Unallowed notifications sending (CVSS 7.1, glpi-project glpi)
- [CVE-2026-54382](https://cve.now/CVE-2026-54382.md): VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access (CVSS 6.3, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-86041](https://cve.now/CVE-2026-86041.md): ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed \`X-Forwarded-For\` header (CVSS 5.3, mayswind ezbookkeeping)
- [CVE-2026-122028](https://cve.now/CVE-2026-122028.md): NST Labs Tech Nstbrowser Local Agent API info information disclosure (CVSS 5.3, NST Labs Tech Nstbrowser)
- [CVE-2026-54381](https://cve.now/CVE-2026-54381.md): VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure (CVSS 8.7, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-76892](https://cve.now/CVE-2026-76892.md): tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process (CVSS 8.7, tsparticles · @tsparticles mcp-server)
- [CVE-2026-76826](https://cve.now/CVE-2026-76826.md): tsParticles: Generated release notes can execute shell commands in the stable publish workflow (CVSS 7.5, tsparticles)
- [CVE-2026-54380](https://cve.now/CVE-2026-54380.md): VitaFit Cloud API Stored XSS via SVG File Upload (CVSS 5.1, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-76893](https://cve.now/CVE-2026-76893.md): tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients (CVSS 6.9, tsparticles · @tsparticles mcp-server)
- [CVE-2026-54378](https://cve.now/CVE-2026-54378.md): VitaFit Cloud API Broken Access Control via S3 Token Endpoint (CVSS 9.3, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-54377](https://cve.now/CVE-2026-54377.md): VitaFit Cloud API IDOR via profile\_id Endpoints (CVSS 6.9, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-63655](https://cve.now/CVE-2026-63655.md): tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS (CVSS 7.5, tsparticles · @tsparticles mcp-server)
- [CVE-2026-54376](https://cve.now/CVE-2026-54376.md): VitaFit Android \< 2.8.1.0 Custom URI Scheme Token Hijacking (CVSS 8.2, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-122020](https://cve.now/CVE-2026-122020.md): NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service (CVSS 5.3, NST Labs Tech Nstbrowser)
- [CVE-2026-102280](https://cve.now/CVE-2026-102280.md): Sandboxie-Plus: Sandbox containment bypass (CVSS 6.9, sandboxie-plus Sandboxie)
- [CVE-2026-54375](https://cve.now/CVE-2026-54375.md): VitaFit Android \< 2.8.1.0 Long-Lived Session Token Exposure (CVSS 8.6, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-54374](https://cve.now/CVE-2026-54374.md): VitaFit Android \< 2.8.1.0 Hardcoded Credentials Disclosure (CVSS 8.7, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-54373](https://cve.now/CVE-2026-54373.md): VitaFit Android \< 2.8.1.0 Cleartext Traffic via Missing Network Security Config (CVSS 5.1, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-54372](https://cve.now/CVE-2026-54372.md): VitaFit Android \< 2.8.1.0 Insecure TLS Certificate Validation (CVSS 8.7, Shenzhen Shine Industrial Co. VitaFit)
- [CVE-2026-57562](https://cve.now/CVE-2026-57562.md): Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller (CVSS 6.5, readest)
- [CVE-2026-57565](https://cve.now/CVE-2026-57565.md): Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal) (CVSS 6.5, readest)
- [CVE-2026-122019](https://cve.now/CVE-2026-122019.md): 6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization (CVSS 6.9, 6amTech 6valley)
- [CVE-2026-57566](https://cve.now/CVE-2026-57566.md): Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy (CVSS 9.3, readest)
- [CVE-2026-122266](https://cve.now/CVE-2026-122266.md): Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS (CVSS 8.7, aws-network-policy-agent · AWS amazon-vpc-cni-k8s)
- [CVE-2026-57567](https://cve.now/CVE-2026-57567.md): Readest: Unscoped Tauri IPC download\_file/upload\_file allow arbitrary local file write and read from the webview (CVSS 8.6, readest)
- [CVE-2026-115473](https://cve.now/CVE-2026-115473.md): Mongoose: Heap OOB reads and null-byte bypass in mg\_path\_is\_sane (util.c) (CVSS 6.5, cesanta mongoose)
- [CVE-2026-55367](https://cve.now/CVE-2026-55367.md): h2o: heap exhaustion using capsules (CVSS 7.5, h2o)
- [CVE-2026-55368](https://cve.now/CVE-2026-55368.md): h2o: buffer overflow when using the %{error}x log directive (CVSS 8.1, h2o)
- [CVE-2026-103002](https://cve.now/CVE-2026-103002.md): GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover (CVSS 8.8, gpustack)
- [CVE-2026-121746](https://cve.now/CVE-2026-121746.md): nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write (CVSS 6.7, nvm-sh nvm)
- [CVE-2026-58128](https://cve.now/CVE-2026-58128.md): Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity (CVSS 6.9, Alan Health Alan: Health Insurance)
- [CVE-2026-121749](https://cve.now/CVE-2026-121749.md): nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files (CVSS 4.6, nvm-sh nvm)
- [CVE-2026-121747](https://cve.now/CVE-2026-121747.md): nvm prints the contents of any readable file through a symlinked .nvmrc (CVSS 6.7, nvm-sh nvm)
- [CVE-2026-122016](https://cve.now/CVE-2026-122016.md): yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management (CVSS 5.3, yangzongzhuan RuoYi-Vue)
- [CVE-2026-121748](https://cve.now/CVE-2026-121748.md): nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable (CVSS 1.8, nvm-sh nvm)
- [CVE-2026-121750](https://cve.now/CVE-2026-121750.md): nvm install --offline installs a cached tarball that previously failed checksum verification (CVSS 2.1, nvm-sh nvm)
- [CVE-2026-121745](https://cve.now/CVE-2026-121745.md): nvm exposes NVM\_AUTH\_HEADER to other local users on the curl/wget command line (CVSS 2.0, nvm-sh nvm)
- [CVE-2026-121751](https://cve.now/CVE-2026-121751.md): nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases (CVSS 2.1, nvm-sh nvm)
- [CVE-2026-102894](https://cve.now/CVE-2026-102894.md): GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover (CVSS 9.1, gpustack)
- [CVE-2026-102895](https://cve.now/CVE-2026-102895.md): GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated… (CVSS 9.8, gpustack)
- [CVE-2026-122015](https://cve.now/CVE-2026-122015.md): NPC-Worldwide npcpy MLX Provider response.py get\_mlx\_response input validation (CVSS 5.3, NPC-Worldwide npcpy)
- [CVE-2026-97693](https://cve.now/CVE-2026-97693.md): Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise (CVSS 9.9, xerrors Yuxi)
- [CVE-2026-122235](https://cve.now/CVE-2026-122235.md): Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink (CVSS 5.7, janhq jan)
- [CVE-2026-122234](https://cve.now/CVE-2026-122234.md): jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters (CVSS 2.3, benjamine jsondiffpatch)
- [CVE-2026-122233](https://cve.now/CVE-2026-122233.md): FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode (CVSS 6.3, frankenphp)
- [CVE-2026-16725](https://cve.now/CVE-2026-16725.md): IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith (CVSS 6.5, IBM Watson Speech Services Cartridge)
- [CVE-2026-19319](https://cve.now/CVE-2026-19319.md): IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read in Onnx (CVSS 5.3, IBM Watson Speech Services Cartridge)
- [CVE-2026-82418](https://cve.now/CVE-2026-82418.md): IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL (CVSS 9.8, IBM Watson Speech Services Cartridge)
- [CVE-2026-17493](https://cve.now/CVE-2026-17493.md): IBM Watson Speech Services Cartridge is vulnerable to a D.O.S. in Unpacker. (CVSS 7.5, IBM Watson Speech Services Cartridge)
- [CVE-2026-122014](https://cve.now/CVE-2026-122014.md): NPC-Worldwide npcpy sft.py load\_sft\_model code injection (CVSS 5.3, NPC-Worldwide npcpy)
- [CVE-2026-105702](https://cve.now/CVE-2026-105702.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 4.3, IBM Db2 Genius Hub)
- [CVE-2026-105991](https://cve.now/CVE-2026-105991.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 3.5, IBM Db2 Genius Hub)
- [CVE-2026-108536](https://cve.now/CVE-2026-108536.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 4.6, IBM Db2 Genius Hub)
- [CVE-2026-108588](https://cve.now/CVE-2026-108588.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 5.4, IBM Db2 Genius Hub)
- [CVE-2026-108767](https://cve.now/CVE-2026-108767.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 4.3, IBM Db2 Genius Hub)
- [CVE-2026-108838](https://cve.now/CVE-2026-108838.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 3.3, IBM Db2 Genius Hub)
- [CVE-2026-108910](https://cve.now/CVE-2026-108910.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 4.3, IBM Db2 Genius Hub)
- [CVE-2026-110281](https://cve.now/CVE-2026-110281.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 5.9, IBM Db2 Genius Hub)
- [CVE-2026-110282](https://cve.now/CVE-2026-110282.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 6.5, IBM Db2 Genius Hub)
- [CVE-2026-110283](https://cve.now/CVE-2026-110283.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 4.3, IBM Db2 Genius Hub)
- [CVE-2026-116376](https://cve.now/CVE-2026-116376.md): Multiple vulnerabilities that affects IBM Db2 Genius Hub (CVSS 3.4, IBM Db2 Genius Hub)
- [CVE-2026-115762](https://cve.now/CVE-2026-115762.md): draw.io: Prototype pollution in GraphML (mxGraphMlCodec) (CVSS 6.1, jgraph drawio)
- [CVE-2026-97373](https://cve.now/CVE-2026-97373.md): draw.io: Incomplete SSRF blocklist in \`ProxyServlet\` / \`Utils.sanitizeUrl\`: RFC 6598 CGNAT range \`100.64.0.0/10\` is not blocked -\>… (CVSS 5.8, jgraph drawio)
- [CVE-2026-104203](https://cve.now/CVE-2026-104203.md): Traccar: Authentication bypass via path parameters exposes protected device media (CVSS 7.5, traccar)
- [CVE-2026-122013](https://cve.now/CVE-2026-122013.md): Comfast CF-WR632AX Multipart webmgnt path traversal (CVSS 10.0, Comfast CF-WR632AX)
- [CVE-2026-115758](https://cve.now/CVE-2026-115758.md): SumatraPDF: TLS hostname validation disabled in \`HttpGet()\` (CVSS 8.2, sumatrapdfreader sumatrapdf)
- [CVE-2026-102664](https://cve.now/CVE-2026-102664.md): ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path (CVSS 7.1, sysown proxysql)
- [CVE-2026-102340](https://cve.now/CVE-2026-102340.md): Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment… (CVSS 8.5, telepresenceio telepresence)
- [CVE-2026-122224](https://cve.now/CVE-2026-122224.md): WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints (CVSS 7.2, retspen webvirtcloud)
- [CVE-2026-122140](https://cve.now/CVE-2026-122140.md): Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass (CVSS 6.3, germondai trawl)
- [CVE-2026-122139](https://cve.now/CVE-2026-122139.md): blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset (CVSS 6.9, blueprintue-self-hosted-edition)
- [CVE-2026-122138](https://cve.now/CVE-2026-122138.md): BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass (CVSS 6.3, blueprintue-self-hosted-edition)
- [CVE-2026-122137](https://cve.now/CVE-2026-122137.md): Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer (CVSS 5.4, romkatv powerlevel10k · romkatv gitstatus)
- [CVE-2026-122136](https://cve.now/CVE-2026-122136.md): Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File (CVSS 4.1, romkatv powerlevel10k)
- [CVE-2026-122135](https://cve.now/CVE-2026-122135.md): Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program (CVSS 8.6, mistralai mistral-vibe)
- [CVE-2026-122134](https://cve.now/CVE-2026-122134.md): Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers (CVSS 8.6, mistralai mistral-vibe)
- [CVE-2026-122133](https://cve.now/CVE-2026-122133.md): Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe (CVSS 8.6, mistralai mistral-vibe)
- [CVE-2026-122132](https://cve.now/CVE-2026-122132.md): go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware (CVSS 5.1, go-chi chi)
- [CVE-2026-122131](https://cve.now/CVE-2026-122131.md): Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via proto Language Key (CVSS 6.3, hapijs joi)
- [CVE-2026-122130](https://cve.now/CVE-2026-122130.md): CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin (CVSS 8.3, CESNET ipfixcol2)
- [CVE-2026-122129](https://cve.now/CVE-2026-122129.md): CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder (CVSS 6.9, CESNET ipfixcol2)
- [CVE-2026-122127](https://cve.now/CVE-2026-122127.md): CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder (CVSS 8.7, CESNET ipfixcol2)
- [CVE-2026-122126](https://cve.now/CVE-2026-122126.md): reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket (CVSS 8.2, resiprocate)
- [CVE-2026-121969](https://cve.now/CVE-2026-121969.md): netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage (CVSS 7.1, quozl netrek-client-cow)
- [CVE-2026-121968](https://cve.now/CVE-2026-121968.md): Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP\_S\_MESSAGE Packets (CVSS 7.1, quozl netrek-client-cow)
- [CVE-2025-71457](https://cve.now/CVE-2025-71457.md): vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php (CVSS 9.3, vtenext)
- [CVE-2025-71456](https://cve.now/CVE-2025-71456.md): vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView (CVSS 8.6, vtenext)
- [CVE-2025-71455](https://cve.now/CVE-2025-71455.md): vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service (CVSS 5.9, vtenext)
- [CVE-2025-71454](https://cve.now/CVE-2025-71454.md): vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering (CVSS 6.9, vtenext)
- [CVE-2025-71453](https://cve.now/CVE-2025-71453.md): vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList (CVSS 5.1, vtenext)
- [CVE-2026-102339](https://cve.now/CVE-2026-102339.md): Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable (CVSS 8.2, telepresenceio telepresence)
- [CVE-2026-122009](https://cve.now/CVE-2026-122009.md): DataLinkDC Dinky flink\_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side… (CVSS 6.9, DataLinkDC Dinky)
- [CVE-2026-10859](https://cve.now/CVE-2026-10859.md): IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability (CVSS 7.5, IBM MQ)
- [CVE-2026-11376](https://cve.now/CVE-2026-11376.md): IBM MQ is affected by a denial of service vulnerability (CVSS 8.8, IBM MQ)
- [CVE-2026-11724](https://cve.now/CVE-2026-11724.md): IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability (CVSS 8.5, IBM MQ)
- [CVE-2026-12356](https://cve.now/CVE-2026-12356.md): IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability (CVSS 7.5, IBM MQ)
- [CVE-2026-12538](https://cve.now/CVE-2026-12538.md): IBM MQ Appliance is affected by an improper validation vulnerability (CVSS 5.4, IBM MQ Appliance)
- [CVE-2026-12550](https://cve.now/CVE-2026-12550.md): IBM MQ is affected by a denial of service vulnerability (CVSS 5.4, IBM MQ)
- [CVE-2026-13271](https://cve.now/CVE-2026-13271.md): IBM MQ Managed File Transfer is affected by a denial of service vulnerability (CVSS 8.1, IBM MQ)
- [CVE-2026-13284](https://cve.now/CVE-2026-13284.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-13289](https://cve.now/CVE-2026-13289.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-13292](https://cve.now/CVE-2026-13292.md): IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability (CVSS 8.8, IBM MQ)
- [CVE-2026-14252](https://cve.now/CVE-2026-14252.md): IBM MQ is affected by a pasword disclosure vulnerability in the runmqccred utility (CVSS 6.2, IBM MQ)
- [CVE-2026-18142](https://cve.now/CVE-2026-18142.md): IBM MQ is affected by a denial of service vulnerability (CVSS 7.1, IBM MQ)
- [CVE-2026-122220](https://cve.now/CVE-2026-122220.md): WPO365 LOGIN before 45.2 SAML Replay Protection Bypass (CVSS 9.1, WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION)
- [CVE-2026-113368](https://cve.now/CVE-2026-113368.md): Nexus Repository 3 - Group Repository Member Authorization Bypass (CVSS 5.3, Sonatype Nexus Repository)
- [CVE-2026-113369](https://cve.now/CVE-2026-113369.md): Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab (CVSS 6.3, Sonatype Nexus Repository)
- [CVE-2026-113370](https://cve.now/CVE-2026-113370.md): Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task (CVSS 7.7, Sonatype Nexus Repository)
- [CVE-2026-113371](https://cve.now/CVE-2026-113371.md): Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase (CVSS 7.1, Sonatype Nexus Repository)
- [CVE-2026-113372](https://cve.now/CVE-2026-113372.md): Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key (CVSS 7.1, Sonatype Nexus Repository)
- [CVE-2026-113373](https://cve.now/CVE-2026-113373.md): Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again (CVSS 9.1, Sonatype Nexus Repository)
- [CVE-2026-113374](https://cve.now/CVE-2026-113374.md): Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation (CVSS 8.6, Sonatype Nexus Repository)
- [CVE-2026-122192](https://cve.now/CVE-2026-122192.md): Guest access to Firecracker process memory after a failed memory discard (CVSS 7.5, AWS firecracker)
- [CVE-2026-76806](https://cve.now/CVE-2026-76806.md): Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle (CVSS 6.3, solidtime-io solidtime)
- [CVE-2026-97705](https://cve.now/CVE-2026-97705.md): Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser (CVSS 7.5, moleculerjs moleculer)
- [CVE-2026-121933](https://cve.now/CVE-2026-121933.md): Linksys E5350 Setup Wizard apply.cgi save\_settings missing authentication (CVSS 10.0, Linksys E5350)
- [CVE-2026-115474](https://cve.now/CVE-2026-115474.md): Zulip: Saving a draft DM to a user bypasses can\_access\_all\_users\_group permission (CVSS 6.5, zulip)
- [CVE-2026-115574](https://cve.now/CVE-2026-115574.md): Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels (CVSS 5.3, zulip)
- [CVE-2026-97701](https://cve.now/CVE-2026-97701.md): Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests (CVSS 6.5, zulip)
- [CVE-2026-63183](https://cve.now/CVE-2026-63183.md): OmniAuth: Host Header Injection Vulnerability (CVSS 6.9, omniauth)
- [CVE-2026-113780](https://cve.now/CVE-2026-113780.md): ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary (CVSS 9.3, espressif esp-idf)
- [CVE-2026-113783](https://cve.now/CVE-2026-113783.md): ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses (CVSS 7.4, espressif esp-idf)
- [CVE-2026-107846](https://cve.now/CVE-2026-107846.md): bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list (CVSS 9.3, bitcoinjs-lib)
- [CVE-2026-121932](https://cve.now/CVE-2026-121932.md): Linksys E5350 apply.cgi system os command injection (CVSS 10.0, Linksys E5350)
- [CVE-2026-102345](https://cve.now/CVE-2026-102345.md): Zammad: Stored XSS in ticket article rendering in the new Vue-based interface (CVSS 5.1, zammad)
- [CVE-2026-113782](https://cve.now/CVE-2026-113782.md): ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing (CVSS 7.1, espressif esp-idf)
- [CVE-2026-121931](https://cve.now/CVE-2026-121931.md): Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection (CVSS 9.4, Linksys WRT54GL)
- [CVE-2026-82033](https://cve.now/CVE-2026-82033.md): DeepSeek Harness Unauthenticated RPC Command Execution (CVSS 8.6, deepseek-ai deepseek-harness)
- [CVE-2026-121930](https://cve.now/CVE-2026-121930.md): Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection (CVSS 9.4, Linksys WRT54GL)
- [CVE-2026-122148](https://cve.now/CVE-2026-122148.md): In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. (CVSS 8.2, Yealink MeetingBoard Pro)
- [CVE-2026-82029](https://cve.now/CVE-2026-82029.md): Invoice Ninja \< 5.13.28 Broken Access Control via Vendor Portal (CVSS 7.1, invoiceninja)
- [CVE-2026-121929](https://cve.now/CVE-2026-121929.md): EmpireSoft EmpireCMS index.php cross site scripting (CVSS 5.1, EmpireSoft EmpireCMS)
- [CVE-2026-122124](https://cve.now/CVE-2026-122124.md): On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB… (CVSS 6.1, Yealink UVC40 E2)
- [CVE-2026-122120](https://cve.now/CVE-2026-122120.md): In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be… (CVSS 9.0, Yealink Plug-in Softwares)
- [CVE-2026-121928](https://cve.now/CVE-2026-121928.md): InfiniFlow RAGFlow Images API file\_utils.py cross site scripting (CVSS 5.1, InfiniFlow RAGFlow)
- [CVE-2026-122118](https://cve.now/CVE-2026-122118.md): In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient… (CVSS 7.4, Yealink AVHub · Yealink UVC86 +6)
- [CVE-2026-57853](https://cve.now/CVE-2026-57853.md): DataGerry \< 3.3.0 SSTI via DocAPI Template Rendering (CVSS 8.7, DataGerry)
- [CVE-2026-122116](https://cve.now/CVE-2026-122116.md): Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network… (CVSS 4.3, Yealink T3XW Series Phones · Yealink T4X Series Phones +11)
- [CVE-2026-121927](https://cve.now/CVE-2026-121927.md): InfiniFlow RAGFlow Seafile Connector seafile\_connector.py \_account\_get server-side request forgery (CVSS 5.3, InfiniFlow RAGFlow)
- [CVE-2026-121971](https://cve.now/CVE-2026-121971.md): Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References (CVSS 8.2, sensiolabs symfony/http-client)
- [CVE-2026-122054](https://cve.now/CVE-2026-122054.md): BIG-HKSCS decoding hang on crafted input (CVSS 5.9, The GNU C Library glibc)
- [CVE-2026-121926](https://cve.now/CVE-2026-121926.md): yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication (CVSS 6.9, yezhihao jt808-server)
- [CVE-2026-119749](https://cve.now/CVE-2026-119749.md): GetPaid WordPress Plugin \< 2.8.63 Negative Quantity Payment Bypass (CVSS 8.7, AyeCode Payment forms, Buy now buttons, and Invoicing Syste…)
- [CVE-2026-119748](https://cve.now/CVE-2026-119748.md): GetPaid WordPress Plugin \< 2.8.63 Authorization Bypass via maybe\_use\_invoice (CVSS 6.9, AyeCode Payment forms, Buy now buttons, and Invoicing Syste…)
- [CVE-2026-119747](https://cve.now/CVE-2026-119747.md): GetPaid WordPress Plugin \< 2.8.63 Incorrect Authorization via REST API (CVSS 7.1, AyeCode Payment forms, Buy now buttons, and Invoicing Syste…)
- [CVE-2026-20241](https://cve.now/CVE-2026-20241.md): Cisco Identity Services Engine Authorization Bypass Vulnerability (CVSS 5.3, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76419](https://cve.now/CVE-2026-76419.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2026-76506](https://cve.now/CVE-2026-76506.md): Cisco Unified Computing System Central Remote Code Execution Vulnerability (CVSS 7.6, Cisco Unified Computing System Central Software)
- [CVE-2026-106554](https://cve.now/CVE-2026-106554.md): jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC) (medium (no CVSS), com.fasterxml.jackson.dataformat:jackson-dataformat-cbor ·…)
- [CVE-2026-109518](https://cve.now/CVE-2026-109518.md): APT RCE via hard link reuse (CVSS 7.7, Debian APT · Ubuntu APT)
- [CVE-2026-119746](https://cve.now/CVE-2026-119746.md): ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies (CVSS 8.2, ProSoft Technology X35-HWC-A · ProSoft Technology ICX35-HWC…)
- [CVE-2026-121967](https://cve.now/CVE-2026-121967.md): Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal (CVSS 2.3, coder)
- [CVE-2026-121966](https://cve.now/CVE-2026-121966.md): Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak (CVSS 7.0, traefik)
- [CVE-2026-121965](https://cve.now/CVE-2026-121965.md): Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key (CVSS 6.0, parse-community parse-server)
- [CVE-2026-121964](https://cve.now/CVE-2026-121964.md): FreeRDP before 3.32.2 Heap Buffer Overflow via rpc\_client\_recv\_fragment (CVSS 8.7, FreeRDP)
- [CVE-2026-121963](https://cve.now/CVE-2026-121963.md): FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close (CVSS 8.2, FreeRDP)
- [CVE-2026-121962](https://cve.now/CVE-2026-121962.md): FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read (CVSS 7.2, FreeRDP)
- [CVE-2026-121961](https://cve.now/CVE-2026-121961.md): FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race (CVSS 8.2, FreeRDP)
- [CVE-2026-121960](https://cve.now/CVE-2026-121960.md): FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest (CVSS 8.7, FreeRDP)
- [CVE-2026-121959](https://cve.now/CVE-2026-121959.md): FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame (CVSS 7.1, FreeRDP)
- [CVE-2026-121958](https://cve.now/CVE-2026-121958.md): FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable\_GetKeys (CVSS 8.7, FreeRDP)
- [CVE-2026-121957](https://cve.now/CVE-2026-121957.md): FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race (CVSS 8.7, FreeRDP)
- [CVE-2026-121956](https://cve.now/CVE-2026-121956.md): FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt (CVSS 8.7, FreeRDP)
- [CVE-2026-121955](https://cve.now/CVE-2026-121955.md): FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext (CVSS 8.7, FreeRDP)
- [CVE-2026-121954](https://cve.now/CVE-2026-121954.md): FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec (CVSS 7.1, FreeRDP)
- [CVE-2026-121953](https://cve.now/CVE-2026-121953.md): FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close (CVSS 9.3, FreeRDP)
- [CVE-2026-121952](https://cve.now/CVE-2026-121952.md): FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability (CVSS 9.3, FreeRDP)
- [CVE-2026-121951](https://cve.now/CVE-2026-121951.md): FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event (CVSS 8.7, FreeRDP)
- [CVE-2026-121950](https://cve.now/CVE-2026-121950.md): FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE\_SURFACE Integer Wrap (CVSS 7.1, FreeRDP)
- [CVE-2026-92704](https://cve.now/CVE-2026-92704.md): SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution (CVSS 8.3, sharpemu)
- [CVE-2026-91163](https://cve.now/CVE-2026-91163.md): Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller (CVSS 3.7, warp-tech warpgate)
- [CVE-2026-91168](https://cve.now/CVE-2026-91168.md): Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account (CVSS 6.8, warp-tech warpgate)
- [CVE-2026-122032](https://cve.now/CVE-2026-122032.md): SPIP before 4.4.29 Authenticated SQL Injection via where Parameter (CVSS 7.1, SPIP)
- [CVE-2026-120421](https://cve.now/CVE-2026-120421.md): Reflected XSS via client window id in URL client window mode (CVSS 6.1, Eclipse Foundation Eclipse Mojarra)
- [CVE-2026-100408](https://cve.now/CVE-2026-100408.md): Git for Windows: git-credential-wincred Erase Path Heap Overflow (CVSS 4.4, git-for-windows git)
- [CVE-2026-100407](https://cve.now/CVE-2026-100407.md): Git for Windows: git-credential-wincred OAuth Store Heap Overflow (CVSS 4.4, git-for-windows git)
- [CVE-2026-122008](https://cve.now/CVE-2026-122008.md): Oqtane Framework before 10.3.0 SSRF via File Upload From URL (CVSS 5.3, oqtane.framework)
- [CVE-2026-122007](https://cve.now/CVE-2026-122007.md): Oqtane Framework before 10.3.0 Broken Access Control via SettingController (CVSS 7.4, oqtane.framework)
- [CVE-2026-121637](https://cve.now/CVE-2026-121637.md): WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results (CVSS 8.9, WatchGuard AuthPoint Authentication Gateway)
- [CVE-2026-121639](https://cve.now/CVE-2026-121639.md): WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service (CVSS 9.2, WatchGuard AuthPoint Authentication Gateway)
- [CVE-2026-121638](https://cve.now/CVE-2026-121638.md): WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks (CVSS 9.1, WatchGuard AuthPoint Authentication Gateway)
- [CVE-2026-121640](https://cve.now/CVE-2026-121640.md): WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions (CVSS 9.1, WatchGuard AuthPoint Authentication Gateway)
- [CVE-2026-121009](https://cve.now/CVE-2026-121009.md): SQL::Abstract versions from 1.90\_01 before 2.000001\_04 for Perl skip the injection\_guard check for function names given with -func (no CVSS, SQL-Abstract)
- [CVE-2026-121008](https://cve.now/CVE-2026-121008.md): SQL::Abstract::Tree versions before 2.000001\_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html… (no CVSS, SQL-Abstract)
- [CVE-2026-121007](https://cve.now/CVE-2026-121007.md): SQL::Abstract versions from 1.90\_01 before 2.000001\_04 for Perl allow SQL injection via the where values of a nested statement in an… (no CVSS, SQL-Abstract)
- [CVE-2026-114627](https://cve.now/CVE-2026-114627.md): Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output (no CVSS, Web-Simple)
- [CVE-2026-121632](https://cve.now/CVE-2026-121632.md): Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping (no CVSS, Data-MuForm)
- [CVE-2026-119776](https://cve.now/CVE-2026-119776.md): frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses (CVSS 6.1, frrouting)
- [CVE-2026-122006](https://cve.now/CVE-2026-122006.md): The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write… (CVSS 9.8, rubyonrails Active Storage)
- [CVE-2026-119745](https://cve.now/CVE-2026-119745.md): Sender WordPress Plugin \< 2.11.3 Broken Access Control via admin\_post\_sender\_debug\_download (CVSS 5.3, Sender – Newsletter, SMS and Email Marketing Automation for…)
- [CVE-2026-118391](https://cve.now/CVE-2026-118391.md): Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto (CVSS 8.9, elixir-ecto ecto · ecto)
- [CVE-2026-121993](https://cve.now/CVE-2026-121993.md): wePOS before 2.0.3 Missing Authorization via payment/process Endpoint (CVSS 5.3, wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan)
- [CVE-2026-121970](https://cve.now/CVE-2026-121970.md): Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery (CVSS 6.3, wphostingdev Pay with Vipps and MobilePay for WooCommerce)
- [CVE-2026-121373](https://cve.now/CVE-2026-121373.md): Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for… (CVSS 5.3, sensiolabs symfony/html-sanitizer)
- [CVE-2026-121147](https://cve.now/CVE-2026-121147.md): Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application (CVSS 8.5, Tata Motors iRA · Tata Motors iRA.ev)
- [CVE-2026-121146](https://cve.now/CVE-2026-121146.md): Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application (CVSS 6.8, Tata Motors iRA · Tata Motors iRA.ev)
- [CVE-2026-121620](https://cve.now/CVE-2026-121620.md): CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification (CVSS 8.3, coopcycle-web)
- [CVE-2026-121145](https://cve.now/CVE-2026-121145.md): Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application (CVSS 7.1, Tata Motors iRA · Tata Motors iRA.ev)
- [CVE-2026-118516](https://cve.now/CVE-2026-118516.md): Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control (CVSS 6.3, sensiolabs symfony/routing)
- [CVE-2026-121946](https://cve.now/CVE-2026-121946.md): zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders (CVSS 6.9, zbateson mail-mime-parser)
- [CVE-2026-121945](https://cve.now/CVE-2026-121945.md): CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint (CVSS 7.2, coopcycle-web)
- [CVE-2026-121944](https://cve.now/CVE-2026-121944.md): sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV (CVSS 6.8, irontec sngrep)
- [CVE-2026-121943](https://cve.now/CVE-2026-121943.md): Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip\_check\_packet (CVSS 6.3, irontec sngrep)
- [CVE-2026-121942](https://cve.now/CVE-2026-121942.md): ZBar through 0.23.95 Out-of-Bounds Read via \_zbar\_sq\_decode() in sqcode.c (CVSS 6.9, mchehab zbar)
- [CVE-2026-121941](https://cve.now/CVE-2026-121941.md): libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex (CVSS 8.5, munt libmt32emu)
- [CVE-2026-121940](https://cve.now/CVE-2026-121940.md): Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers (CVSS 8.7, Stonewuu ai-fusion-video)
- [CVE-2026-121939](https://cve.now/CVE-2026-121939.md): Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking (CVSS 9.2, David-Crty Databasement)
- [CVE-2026-121938](https://cve.now/CVE-2026-121938.md): langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid} (CVSS 6.0, moyangzhan langchain4j-aideepin)
- [CVE-2026-121937](https://cve.now/CVE-2026-121937.md): loonflow before r3.2.3 IDOR via ticket\_flow\_history Endpoint (CVSS 2.3, blackholll loonflow)
- [CVE-2026-121936](https://cve.now/CVE-2026-121936.md): easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API (CVSS 6.9, cosin2077 easyVoice)
- [CVE-2026-121144](https://cve.now/CVE-2026-121144.md): Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application (CVSS 8.8, Tata Motors iRA · Tata Motors iRA.ev)
- [CVE-2026-118513](https://cve.now/CVE-2026-118513.md): Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063) (CVSS 7.7, sensiolabs symfony/security-http)
- [CVE-2026-107479](https://cve.now/CVE-2026-107479.md): Integer truncation vulnerability in QTextCodec conversion functions impacts Qt Framework (CVSS 1.7, Qt)
- [CVE-2026-119468](https://cve.now/CVE-2026-119468.md): WordPress Noptin plugin \<= 4.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Noptin Newsletter Team Noptin)
- [CVE-2026-119481](https://cve.now/CVE-2026-119481.md): WordPress JetFormBuilder plugin \<= 3.6.7.1 - Privilege Escalation vulnerability (CVSS 9.8, Crocoblock JetFormBuilder)
- [CVE-2026-65555](https://cve.now/CVE-2026-65555.md): WordPress Uncanny Toolkit for LearnDash plugin \<= 3.8.2 - Privilege Escalation vulnerability (CVSS 9.8, Uncanny Owl Uncanny Toolkit for LearnDash)
- [CVE-2026-121925](https://cve.now/CVE-2026-121925.md): Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver (CVSS 6.6, Snowflake PHP PDO Driver · Snowflake Libsnowflakeclient)
- [CVE-2026-104799](https://cve.now/CVE-2026-104799.md): Mobile builder \<= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters (CVSS 8.8, rnlab Mobile builder)
- [CVE-2026-97397](https://cve.now/CVE-2026-97397.md): Remove Google Fonts \<= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer (CVSS 7.2, easywpstuff Remove Google Fonts – Disable, Block, or Replac…)
- [CVE-2026-114456](https://cve.now/CVE-2026-114456.md): Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers (CVSS 6.5, snowflake-connector-python · github.com/snowflakedb/gosn… +9)
- [CVE-2026-59267](https://cve.now/CVE-2026-59267.md): Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption (CVSS 5.8, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90632](https://cve.now/CVE-2026-90632.md): Apache OpenOffice: Local file inclusion via GStreamer plugin (CVSS 5.5, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90634](https://cve.now/CVE-2026-90634.md): Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files (CVSS 7.3, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90631](https://cve.now/CVE-2026-90631.md): Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables (CVSS 3.3, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90629](https://cve.now/CVE-2026-90629.md): Apache OpenOffice: Out of bounds memory access during WMF import (CVSS 7.3, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90628](https://cve.now/CVE-2026-90628.md): Apache OpenOffice: Stack overflow in CFF hint handling (CVSS 7.3, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90627](https://cve.now/CVE-2026-90627.md): Apache OpenOffice: Local file inclusion via SQL provider and flat file database references (CVSS 5.5, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90626](https://cve.now/CVE-2026-90626.md): Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files (CVSS 7.3, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-90624](https://cve.now/CVE-2026-90624.md): Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability (CVSS 7.3, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-59268](https://cve.now/CVE-2026-59268.md): Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader (CVSS 7.3, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-59264](https://cve.now/CVE-2026-59264.md): Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer (CVSS 7.8, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-59263](https://cve.now/CVE-2026-59263.md): Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported… (CVSS 1.9, Apache Software Foundation Apache OpenOffice)
- [CVE-2026-100302](https://cve.now/CVE-2026-100302.md): Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling (CVSS 7.1, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-115448](https://cve.now/CVE-2026-115448.md): Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable (CVSS 8.7, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-100300](https://cve.now/CVE-2026-100300.md): Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply… (CVSS 8.7, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-100252](https://cve.now/CVE-2026-100252.md): Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID (CVSS 8.6, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-100235](https://cve.now/CVE-2026-100235.md): Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation (CVSS 6.0, Apache Software Foundation org.apache.zookeeper:zookeeper)
- [CVE-2026-108500](https://cve.now/CVE-2026-108500.md): Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection (no CVSS, Apache Software Foundation Apache ActiveMQ)
- [CVE-2026-102704](https://cve.now/CVE-2026-102704.md): arbitrary read/write via grant copy (CVSS 4.4, Xen)
- [CVE-2026-102703](https://cve.now/CVE-2026-102703.md): arbitrary read/write via grant copy (CVSS 4.4, Xen)
- [CVE-2026-103582](https://cve.now/CVE-2026-103582.md): Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS) (low (no CVSS), Apache Software Foundation Apache.NMS.ActiveMQ)
- [CVE-2026-108946](https://cve.now/CVE-2026-108946.md): Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection (no CVSS, Apache Software Foundation org.apache.activemq:apache-activ…)
- [CVE-2026-111822](https://cve.now/CVE-2026-111822.md): Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation (no CVSS, Apache Software Foundation org.apache.activemq:apache-activ…)
- [CVE-2026-111821](https://cve.now/CVE-2026-111821.md): Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal (no CVSS, Apache Software Foundation org.apache.activemq:apache-activ…)
- [CVE-2026-108949](https://cve.now/CVE-2026-108949.md): Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM (CVSS 6.5, Apache Software Foundation org.apache.activemq:activemq-bro…)
- [CVE-2026-120422](https://cve.now/CVE-2026-120422.md): Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution (CVSS 8.9, Sogou Input Method)
- [CVE-2026-111040](https://cve.now/CVE-2026-111040.md): Multiple vulnerabilities in Coupa’s Total Spend Management Platform (CVSS 5.1, Coupa Total Spend Management Platform)
- [CVE-2026-111038](https://cve.now/CVE-2026-111038.md): Multiple vulnerabilities in Coupa’s Total Spend Management Platform (CVSS 7.3, Coupa Total Spend Management Platform)
- [CVE-2026-111037](https://cve.now/CVE-2026-111037.md): Multiple vulnerabilities in Coupa’s Total Spend Management Platform (CVSS 5.1, Coupa Total Spend Management Platform)
- [CVE-2026-111036](https://cve.now/CVE-2026-111036.md): Multiple vulnerabilities in Coupa’s Total Spend Management Platform (CVSS 8.4, Coupa Total Spend Management Platform)
- [CVE-2026-115498](https://cve.now/CVE-2026-115498.md): Slim Jetpack \<= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field (CVSS 7.2, wingerspeed Slim Jetpack)
- [CVE-2026-120554](https://cve.now/CVE-2026-120554.md): Import and export users and customers \<= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save (CVSS 8.8, carazo Import and export users and customers)
- [CVE-2026-93900](https://cve.now/CVE-2026-93900.md): Simple CAPTCHA with Cloudflare Turnstile \<= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, elliotvs Simple CAPTCHA with Cloudflare Turnstile)
- [CVE-2026-110935](https://cve.now/CVE-2026-110935.md): Path traversal in plug-in deployment (CVSS 8.6, Phoenix Contact PLCnext Engineer)
- [CVE-2026-110022](https://cve.now/CVE-2026-110022.md): Signed plug-in validation bypass (CVSS 8.6, Phoenix Contact PLCnext Engineer)
- [CVE-2026-110021](https://cve.now/CVE-2026-110021.md): Missing GSDX SignatureValue verification (CVSS 6.9, Phoenix Contact PLCnext Engineer)
- [CVE-2026-95649](https://cve.now/CVE-2026-95649.md): IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution (CVSS 6.1, I.R.I.S S.A. IRISPowerscan)
- [CVE-2026-94460](https://cve.now/CVE-2026-94460.md): IRISPowerscan Insecure default privilege assignment for installation account (CVSS 7.2, I.R.I.S S.A. IRISPowerscan)
- [CVE-2026-94459](https://cve.now/CVE-2026-94459.md): IRISPowerscan Default accounts with predictable credentials (CVSS 7.2, I.R.I.S S.A. IRISPowerscan)
- [CVE-2026-114421](https://cve.now/CVE-2026-114421.md): Empty initial password permits GINA account takeover (CVSS 8.3, SEPPmail AG SEPPmail Secure Email Gateway)
- [CVE-2026-114420](https://cve.now/CVE-2026-114420.md): LDAP wildcard injection exposes GINA recipient accounts (CVSS 6.9, SEPPmail AG SEPPmail Secure Email Gateway)
- [CVE-2026-114426](https://cve.now/CVE-2026-114426.md): Pre-authentication upload parsing permits resource exhaustion (CVSS 8.7, SEPPmail AG SEPPmail Secure Email Gateway)
- [CVE-2026-114425](https://cve.now/CVE-2026-114425.md): Forged LFT metadata permits arbitrary file read and deletion (CVSS 9.2, SEPPmail AG SEPPmail Secure Email Gateway)
- [CVE-2026-114424](https://cve.now/CVE-2026-114424.md): Code execution through double evaluation in address replacement rules (CVSS 9.2, SEPPmail AG SEPPmail Secure Email Gateway)
- [CVE-2026-19731](https://cve.now/CVE-2026-19731.md): Path Traversal in TÜBİTAK BİLGEM's İmzager (CVSS 3.3, TÜBİTAK BİLGEM Software Technologies Research Institute İmz…)
- [CVE-2026-19721](https://cve.now/CVE-2026-19721.md): XXE in TÜBİTAK BİLGEM's İmzager (CVSS 3.3, TÜBİTAK BİLGEM Software Technologies Research Institute İmz…)
- [CVE-2026-57666](https://cve.now/CVE-2026-57666.md): WordPress WP Customer Area plugin \<= 8.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Aguila Technologies WP Customer Area)
- [CVE-2026-119366](https://cve.now/CVE-2026-119366.md): WordPress wpDiscuz plugin \<= 7.6.73 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AdvancedCoding wpDiscuz)
- [CVE-2026-62007](https://cve.now/CVE-2026-62007.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.26 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unlimited Elements For Elementor)
- [CVE-2026-54861](https://cve.now/CVE-2026-54861.md): WordPress WP Customer Area plugin \<= 8.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Aguila Technologies WP Customer Area)
- [CVE-2026-62126](https://cve.now/CVE-2026-62126.md): WordPress SAML SP Single Sign On plugin \<= 6.1.0 - Denial of Service Attack vulnerability (CVSS 7.5, miniOrange SAML SP Single Sign On)
- [CVE-2026-57775](https://cve.now/CVE-2026-57775.md): WordPress Simple Cloudflare Turnstile plugin \<= 1.44.1 - Broken Authentication vulnerability (CVSS 5.3, RelyWP Simple Cloudflare Turnstile)
- [CVE-2026-57639](https://cve.now/CVE-2026-57639.md): WordPress WP Booking System plugin \<= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Roland Murg WP Booking System)
- [CVE-2026-119477](https://cve.now/CVE-2026-119477.md): WordPress WP Photo Album Plus plugin \<= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jacob N. Breetvelt WP Photo Album Plus)
- [CVE-2026-56065](https://cve.now/CVE-2026-56065.md): WordPress Doofinder for WooCommerce plugin \<= 2.17.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, Doofinder for WooCommerce)
- [CVE-2026-110944](https://cve.now/CVE-2026-110944.md): Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer) (CVSS 2.7, Qt Framework)
- [CVE-2026-54851](https://cve.now/CVE-2026-54851.md): WordPress Contact Form by WPForms plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Awesomemotive Contact Form by WPForms)
- [CVE-2026-62000](https://cve.now/CVE-2026-62000.md): WordPress WCFM Marketplace plugin \<= 3.8.2 - Broken Access Control vulnerability (CVSS 7.5, WC Lovers WCFM Marketplace)
- [CVE-2026-121818](https://cve.now/CVE-2026-121818.md): About Time Technologies｜Herowatch Go - Security Misconfiguration (CVSS 8.5, About Time Technologies Herowatch Go)
- [CVE-2026-121817](https://cve.now/CVE-2026-121817.md): About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference (CVSS 8.7, About Time Technologies Herowatch Go Server)
- [CVE-2026-121816](https://cve.now/CVE-2026-121816.md): About Time Technologies｜Herowatch Mini - Missing Authentication (CVSS 8.7, About Time Technologies Herowatch Mini)
- [CVE-2026-87044](https://cve.now/CVE-2026-87044.md): Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-87043](https://cve.now/CVE-2026-87043.md): sys\_rand\_get() silently returns an unwritten buffer when the entropy device is not ready (CVSS 4.8, zephyrproject zephyr)
- [CVE-2026-87041](https://cve.now/CVE-2026-87041.md): Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-87040](https://cve.now/CVE-2026-87040.md): Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read… (CVSS 8.3, zephyrproject zephyr)
- [CVE-2026-87039](https://cve.now/CVE-2026-87039.md): I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-87038](https://cve.now/CVE-2026-87038.md): Time-of-check/time-of-use double fetch in the Zephyr i3c\_transfer() syscall handler allows kernel-mode control-flow hijack from user mode (CVSS 7.0, zephyrproject zephyr)
- [CVE-2026-16511](https://cve.now/CVE-2026-16511.md): Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory (CVSS 8.8, zephyrproject zephyr)
- [CVE-2026-85036](https://cve.now/CVE-2026-85036.md): Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue (CVSS 5.7, zephyrproject zephyr)
- [CVE-2026-118983](https://cve.now/CVE-2026-118983.md): VikWidgetsLoader \< 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks (CVSS 6.8, VikWidgetsLoader)
- [CVE-2026-118783](https://cve.now/CVE-2026-118783.md): All-in-One Video Gallery \< 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute (CVSS 6.8, All-in-One Video Gallery)
- [CVE-2026-118637](https://cve.now/CVE-2026-118637.md): Simple Download Monitor \< 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via \[sdm\_show\_download\_info\] Shortcode (CVSS 2.7, Simple Download Monitor)
- [CVE-2026-118523](https://cve.now/CVE-2026-118523.md): EventPrime \< 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override (CVSS 5.3, EventPrime)
- [CVE-2026-118422](https://cve.now/CVE-2026-118422.md): Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path (CVSS 7.1, Stape Conversion Tracking)
- [CVE-2026-118407](https://cve.now/CVE-2026-118407.md): Premium Packages \< 7.3.1 - Subscriber+ Guest Order Takeover (CVSS 5.4, Premium Packages)
- [CVE-2026-118404](https://cve.now/CVE-2026-118404.md): Premium Packages \< 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR (CVSS 5.3, Premium Packages)
- [CVE-2026-118403](https://cve.now/CVE-2026-118403.md): Premium Packages \< 7.3.1 - Unauthenticated Guest Order Status Disclosure (CVSS 3.7, Premium Packages)
- [CVE-2026-115426](https://cve.now/CVE-2026-115426.md): WPvivid Backup & Migration \< 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting (CVSS 5.5, WPvivid — Backup, Migration & Staging)
- [CVE-2026-115262](https://cve.now/CVE-2026-115262.md): Duplicator \< 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore (CVSS 4.8, Duplicator · duplicator-pro)
- [CVE-2026-115257](https://cve.now/CVE-2026-115257.md): WP Roster \< 2.36 - Unauthenticated Roster Data Modification (CVSS 5.3, WP Roster)
- [CVE-2026-115250](https://cve.now/CVE-2026-115250.md): Text Typing \< 2.2.2 - Contributor+ Stored XSS (CVSS 6.8, Text Typing)
- [CVE-2026-115243](https://cve.now/CVE-2026-115243.md): WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid\_upload\_import\_files (CVSS 6.7, WPvivid — Backup, Migration & Staging)
- [CVE-2026-115242](https://cve.now/CVE-2026-115242.md): WPvivid Backup & Migration \< 0.9.137 - Admin+ Path Traversal via Staging Site Path (CVSS 5.5, WPvivid — Backup, Migration & Staging)
- [CVE-2026-115241](https://cve.now/CVE-2026-115241.md): WPvivid Backup & Migration \< 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID (CVSS 6.5, WPvivid — Backup, Migration & Staging)
- [CVE-2026-114431](https://cve.now/CVE-2026-114431.md): Enable Media Replace \< 4.2.3 - Author+ Stored XSS via SVG Upload (CVSS 6.4, Enable Media Replace)
- [CVE-2026-112244](https://cve.now/CVE-2026-112244.md): Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points (CVSS 5.3, Duplicator · duplicator-pro)
- [CVE-2026-112243](https://cve.now/CVE-2026-112243.md): Duplicator \< 5.1.0 - Reflected XSS via 'logname' Parameter (CVSS 5.8, Duplicator · duplicator-pro)
- [CVE-2026-111962](https://cve.now/CVE-2026-111962.md): WP Remote Users Sync \< 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File (CVSS 3.7, WP Remote Users Sync)
- [CVE-2026-111740](https://cve.now/CVE-2026-111740.md): Post Duplicator \< 3.0.17 - Contributor+ Draft and Private Post Title Disclosure (CVSS 2.7, Post Duplicator)
- [CVE-2026-110964](https://cve.now/CVE-2026-110964.md): Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR (CVSS 6.5, Essential Real Estate)
- [CVE-2026-110692](https://cve.now/CVE-2026-110692.md): PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import (CVSS 4.1, PowerPack Addons for Elementor: Widgets, Form Styler and Te…)
- [CVE-2026-108068](https://cve.now/CVE-2026-108068.md): FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard (CVSS 3.8, FV Flowplayer Video Player)
- [CVE-2026-108067](https://cve.now/CVE-2026-108067.md): FV Flowplayer Video Player \< 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure… (CVSS 3.8, FV Flowplayer Video Player)
- [CVE-2026-108041](https://cve.now/CVE-2026-108041.md): SEOPress \< 10.4 - Authenticated Stored XSS via Analytics Tracking Settings (CVSS 7.1, SEOPress)
- [CVE-2026-106649](https://cve.now/CVE-2026-106649.md): Kali Forms \< 2.4.29 - Author+ Stored XSS via Button Click Action (CVSS 6.8, Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-106000](https://cve.now/CVE-2026-106000.md): Booking Package \< 1.7.34 - Unauthenticated Payment Bypass (CVSS 5.3, Booking Package)
- [CVE-2026-105413](https://cve.now/CVE-2026-105413.md): Form Maker by 10Web \< 1.15.51 - Unauthenticated Stored XSS via Submission Field Values (CVSS 7.5, Form Maker by 10Web)
- [CVE-2026-105191](https://cve.now/CVE-2026-105191.md): WP ERP \< 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log (CVSS 4.3, ERP: Complete HR, Accounting & CRM Suite Built for WooComme…)
- [CVE-2026-104719](https://cve.now/CVE-2026-104719.md): CookieYes \< 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts (CVSS 6.4, CookieYes)
- [CVE-2026-101166](https://cve.now/CVE-2026-101166.md): Mollie Payments for WooCommerce \< 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie\_paypal\_create\_order (CVSS 3.7, Mollie Payments for WooCommerce)
- [CVE-2026-101165](https://cve.now/CVE-2026-101165.md): Mollie Payments for WooCommerce \< 8.2.0 - Unauthenticated Payment Surcharge Bypass via update\_surcharge\_order\_pay (CVSS 3.7, Mollie Payments for WooCommerce)
- [CVE-2026-77690](https://cve.now/CVE-2026-77690.md): Command injection vulnerability (CVSS 8.8, Zohocorp ManageEngine Key Manager Plus)
- [CVE-2026-77779](https://cve.now/CVE-2026-77779.md): Improper access control vulnerability (CVSS 7.7, Zohocorp ManageEngine Key Manager Plus)
- [CVE-2025-11229](https://cve.now/CVE-2025-11229.md): Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server (CVSS 7.2, WSO2 Identity Server · WSO2 Identity Application Management…)
- [CVE-2026-11753](https://cve.now/CVE-2026-11753.md): A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the… (CVSS 5.1, LY Armeria)
- [CVE-2026-11749](https://cve.now/CVE-2026-11749.md): A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing… (CVSS 7.6, LY Armeria)
- [CVE-2026-105296](https://cve.now/CVE-2026-105296.md): Multiple Akeeba products lack the anti-CSRF check on some actions. (CVSS 5.4, Akeeba Backup for Joomla! · Akeeba Backup for WordPress +2)
- [CVE-2026-80335](https://cve.now/CVE-2026-80335.md): Out-of-bounds Write in Bootloader (CVSS 8.4, Unisoc (Shanghai) Technologies Co. Bootloader)
- [CVE-2026-79405](https://cve.now/CVE-2026-79405.md): Improper Input Validation in Modem Firmware (CVSS 7.5, Unisoc (Shanghai) Technologies Co. Modem)
- [CVE-2026-121618](https://cve.now/CVE-2026-121618.md): Linksys E5600 Factory Quality Control fqc.cgi information disclosure (CVSS 6.9, Linksys E5600)
- [CVE-2026-121617](https://cve.now/CVE-2026-121617.md): Linksys E5600 Header upload\_fw.cgi init\_multipart out-of-bounds write (CVSS 8.7, Linksys E5600)
- [CVE-2026-121802](https://cve.now/CVE-2026-121802.md): @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address)… (CVSS 9.1, better-auth Better Auth)
- [CVE-2026-121616](https://cve.now/CVE-2026-121616.md): Linksys E5600 JSON Request mesh\_login.cgi strcpy out-of-bounds write (CVSS 6.9, Linksys E5600)
- [CVE-2026-121615](https://cve.now/CVE-2026-121615.md): Linksys E5600 Login mesh\_login.cgi improper authentication (CVSS 10.0, Linksys E5600)
- [CVE-2026-84729](https://cve.now/CVE-2026-84729.md): Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or… (CVSS 7.2, ASUS Router firmware)
- [CVE-2026-84730](https://cve.now/CVE-2026-84730.md): Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with… (CVSS 8.7, ASUS Router firmware)
- [CVE-2026-112116](https://cve.now/CVE-2026-112116.md): An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write… (CVSS 8.5, ASUS System Control Interface)
- [CVE-2026-110464](https://cve.now/CVE-2026-110464.md): Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local… (CVSS 6.9, ASUS Armoury Crate)
- [CVE-2026-121610](https://cve.now/CVE-2026-121610.md): funadmin Frontend List Endpoint index selectList sql injection (CVSS 6.9, funadmin)
- [CVE-2026-121609](https://cve.now/CVE-2026-121609.md): Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials (CVSS 10.0, Qihoo 360 Whole Home Router M5)
- [CVE-2026-121608](https://cve.now/CVE-2026-121608.md): Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on\_push\_message os command injection (CVSS 6.9, Qihoo 360 D603-2 · Qihoo 360 D600-2 +1)
- [CVE-2026-121607](https://cve.now/CVE-2026-121607.md): Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed\_command os command injection (CVSS 10.0, Qihoo 360 D603-2 · Qihoo 360 D600-2 +2)
- [CVE-2026-121606](https://cve.now/CVE-2026-121606.md): Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify\_sign signature verification (CVSS 10.0, Qihoo 360 D621-2 · Qihoo 360 D603-2 +4)
- [CVE-2026-121600](https://cve.now/CVE-2026-121600.md): TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow (CVSS 9.4, TOTOLINK A950RG)
- [CVE-2026-121599](https://cve.now/CVE-2026-121599.md): TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow (CVSS 9.4, TOTOLINK A950RG)
- [CVE-2026-121598](https://cve.now/CVE-2026-121598.md): TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow (CVSS 9.4, TOTOLINK A950RG)
- [CVE-2026-121597](https://cve.now/CVE-2026-121597.md): TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow (CVSS 9.4, TOTOLINK A950RG)
- [CVE-2026-39430](https://cve.now/CVE-2026-39430.md): On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls… (no CVSS)
- [CVE-2026-39431](https://cve.now/CVE-2026-39431.md): On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows… (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.