# CVEs published 2026-11-05

468 CVEs were published on November 5, 2026: 38 critical, 172 high. 12 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-38f944c737](https://cve.now/SZB-38f944c737): DreamHost warns attackers accessed File Manager and stole customer FTP/SFTP credentials
- [SZB-fe91205ead](https://cve.now/SZB-fe91205ead): Phishing campaign reportedly steals Microsoft and Google account credentials
- [SZB-2de54e00e4](https://cve.now/SZB-2de54e00e4): mSeven Software warns mSecure users after cyberattack reportedly exposed customer database
- [SZB-f2f032fedb](https://cve.now/SZB-f2f032fedb): OpenSSH flaw reportedly allows login to password-disabled musl-based Linux accounts
- [SZB-56bfa02295](https://cve.now/SZB-56bfa02295): Trojanized CWP web server reportedly spreads CWPdoor Linux backdoor
- [SZB-58fbd93471](https://cve.now/SZB-58fbd93471): DigiCert warns of breach exposing customer data and identity documents
- [SZB-e57f3ab75f](https://cve.now/SZB-e57f3ab75f): CISA warns attackers are exploiting a patched high-severity WordPress flaw
- [SZB-fefdc7390e](https://cve.now/SZB-fefdc7390e): Anthropic declines to fix Claude Dispatch flaw enabling remote command execution
- [SZB-2b061c991a](https://cve.now/SZB-2b061c991a): Chainalysis says some information on all users was exposed in cyberattack
- [SZB-9fb3d806b5](https://cve.now/SZB-9fb3d806b5): CERT-In flags backdoored ARTEX exposing 62 consoles to root access
- [SZB-646da66be3](https://cve.now/SZB-646da66be3): CISA adds Apple authentication flaw CVE-2024-27834 to KEV catalog
- [SZB-c7e59b0d46](https://cve.now/SZB-c7e59b0d46): OpenAI reports 948 Linux kernel privilege escalation flaws found by AI pipeline

## CVEs

- [CVE-2026-123268](https://cve.now/CVE-2026-123268.md): libyal libvmdk Extent Data File libvmdk\_extent\_table.c libvmdk\_extent\_table\_get\_extent\_data\_file\_path memory corruption (CVSS 5.1, libyal libvmdk)
- [CVE-2026-85068](https://cve.now/CVE-2026-85068.md): NUT blazer\_usb ippon\_command stack info-leak via unzeroed char tmp\[64\] in OUT-direction usb\_control\_msg (CVSS 2.4, networkupstools nut)
- [GO-2026-6893](https://cve.now/GO-2026-6893.md): Event type spoofing via UntrustedType in github.com/google/go-eventlog (no CVSS, github.com/google/go-eventlog)
- [GO-2026-6905](https://cve.now/GO-2026-6905.md): Panic on negative member size in Reader.Read in github.com/blakesmith/ar (no CVSS, github.com/blakesmith/ar)
- [GO-2026-6909](https://cve.now/GO-2026-6909.md): Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml (no CVSS, github.com/crewjam/saml)
- [GO-2026-6911](https://cve.now/GO-2026-6911.md): SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go (no CVSS, github.com/mark3labs/mcp-go)
- [GO-2026-6906](https://cve.now/GO-2026-6906.md): Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoil (no CVSS, github.com/tinfoil-factory/netfoil)
- [GO-2026-6907](https://cve.now/GO-2026-6907.md): Arc has unauthenticated application log disclosure via \`/api/v1/logs\` in github.com/basekick-labs/arc (no CVSS, github.com/basekick-labs/arc)
- [GO-2026-6894](https://cve.now/GO-2026-6894.md): anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in… (no CVSS, github.com/anacrolix/torrent)
- [GO-2026-6891](https://cve.now/GO-2026-6891.md): charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users in… (no CVSS, github.com/charmbracelet/soft-serve)
- [GO-2026-6892](https://cve.now/GO-2026-6892.md): charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve (no CVSS, github.com/charmbracelet/soft-serve)
- [GO-2026-6895](https://cve.now/GO-2026-6895.md): imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in… (no CVSS, github.com/imgproxy/imgproxy · github.com/imgproxy/imgpr… +2)
- [GO-2026-6897](https://cve.now/GO-2026-6897.md): imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in… (no CVSS, github.com/imgproxy/imgproxy · github.com/imgproxy/imgpr… +2)
- [GO-2026-6898](https://cve.now/GO-2026-6898.md): imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data\_size field in… (no CVSS, github.com/imgproxy/imgproxy · github.com/imgproxy/imgpr… +2)
- [GO-2026-6836](https://cve.now/GO-2026-6836.md): SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in… (no CVSS, github.com/siyuan-note/siyuan/kernel)
- [GO-2026-6838](https://cve.now/GO-2026-6838.md): Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4 · github.com/labstack/echo/v5)
- [GO-2026-6839](https://cve.now/GO-2026-6839.md): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4 · github.com/labstack/echo/v5)
- [GO-2026-6840](https://cve.now/GO-2026-6840.md): Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4)
- [GO-2026-6841](https://cve.now/GO-2026-6841.md): Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v5)
- [GO-2026-6842](https://cve.now/GO-2026-6842.md): Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo (no CVSS, github.com/labstack/echo/v4)
- [CVE-2026-113663](https://cve.now/CVE-2026-113663.md): AG2: Newline injection in SandboxShellTool bypasses allowed=\[...\] and readonly=True, enabling arbitrary command execution (CVSS 8.8, ag2ai ag2 · ag2ai autogen)
- [CVE-2026-102943](https://cve.now/CVE-2026-102943.md): Dagu MCP DAG specification read bypasses path containment and workspace isolation (CVSS 6.5, dagucloud dagu)
- [CVE-2026-68509](https://cve.now/CVE-2026-68509.md): FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory (CVSS 6.3, M66B FairEmail)
- [CVE-2026-92698](https://cve.now/CVE-2026-92698.md): FastNetMon: sFlow header\_size field trusted as parser capture length causes remote out-of-bounds read (CVSS 8.2, pavel-odintsov fastnetmon)
- [CVE-2026-92697](https://cve.now/CVE-2026-92697.md): FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read (CVSS 7.5, pavel-odintsov fastnetmon)
- [CVE-2026-110390](https://cve.now/CVE-2026-110390.md): FlexNet Beacon Missing Authentication Vulnerability (CVSS 6.9, Flexera FlexNet Beacon · Flexera FlexNet Manager Suite)
- [CVE-2026-92693](https://cve.now/CVE-2026-92693.md): FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser (CVSS 8.2, pavel-odintsov fastnetmon)
- [CVE-2026-93424](https://cve.now/CVE-2026-93424.md): FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments (CVSS 7.5, pavel-odintsov fastnetmon)
- [CVE-2026-92695](https://cve.now/CVE-2026-92695.md): FastNetMon: Legacy pcap parse\_packet() has no bounds checking, causing out-of-bounds read on truncated frames (CVSS 8.2, pavel-odintsov fastnetmon)
- [CVE-2026-92694](https://cve.now/CVE-2026-92694.md): FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts (CVSS 5.9, pavel-odintsov fastnetmon)
- [CVE-2026-88982](https://cve.now/CVE-2026-88982.md): Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook… (CVSS 5.4, kubeflow pipelines)
- [CVE-2026-77596](https://cve.now/CVE-2026-77596.md): Kubeflow Pipelines API server lacks authorization for shared pipeline uploads (CVSS 9.6, kubeflow pipelines)
- [CVE-2026-88981](https://cve.now/CVE-2026-88981.md): Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints (CVSS 8.6, kubeflow pipelines)
- [CVE-2026-88980](https://cve.now/CVE-2026-88980.md): Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the… (CVSS 8.6, kubeflow pipelines)
- [CVE-2026-88979](https://cve.now/CVE-2026-88979.md): Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy (CVSS 5.8, kubeflow pipelines)
- [CVE-2026-88984](https://cve.now/CVE-2026-88984.md): Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines (CVSS 7.2, kubeflow pipelines)
- [CVE-2026-88986](https://cve.now/CVE-2026-88986.md): Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses (CVSS 6.1, kubeflow pipelines)
- [CVE-2026-88985](https://cve.now/CVE-2026-88985.md): Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server (CVSS 6.5, kubeflow pipelines)
- [CVE-2026-122267](https://cve.now/CVE-2026-122267.md): MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz- headers, letting a presigned PUT URL be… (CVSS 8.8, Chainguard MinIO)
- [CVE-2026-111495](https://cve.now/CVE-2026-111495.md): API keys, credentials, and configuration parameters embedded in the MatchPoint APK (CVSS 5.1, TPC Software Matchpoint)
- [CVE-2026-88983](https://cve.now/CVE-2026-88983.md): Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation (CVSS 5.0, kubeflow pipelines)
- [CVE-2026-111494](https://cve.now/CVE-2026-111494.md): Incorrect validation of TLS certificates in the MatchPoint Android app (CVSS 9.1, TPC Software Matchpoint)
- [CVE-2026-58273](https://cve.now/CVE-2026-58273.md): Rucio: Authorisation Bypass on REST API endpoint for signing URLs (CVSS 8.1, rucio)
- [CVE-2026-111493](https://cve.now/CVE-2026-111493.md): Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint (CVSS 8.7, TPC Software Matchpoint)
- [CVE-2026-112908](https://cve.now/CVE-2026-112908.md): filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a… (CVSS 5.3, tox-dev filelock · filelock)
- [CVE-2026-111492](https://cve.now/CVE-2026-111492.md): SQL injection in the push notification handler of the MatchPoint Android app (CVSS 8.6, TPC Software Matchpoint)
- [CVE-2026-111491](https://cve.now/CVE-2026-111491.md): Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences (CVSS 6.9, TPC Software Matchpoint)
- [CVE-2026-112938](https://cve.now/CVE-2026-112938.md): filelock: StrictSoftFileLock follows a symbolic link swapped in at \<path\>.filelock and creates claim files in a directory another local… (CVSS 5.8, tox-dev filelock · filelock)
- [CVE-2026-112907](https://cve.now/CVE-2026-112907.md): filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break (CVSS 2.5, tox-dev filelock · filelock)
- [CVE-2026-111490](https://cve.now/CVE-2026-111490.md): Insecure direct object reference (IDOR) vulnerability in the MatchPoint API (CVSS 9.9, TPC Software Matchpoint)
- [CVE-2026-112913](https://cve.now/CVE-2026-112913.md): filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database (CVSS 3.3, tox-dev filelock · filelock)
- [CVE-2026-111489](https://cve.now/CVE-2026-111489.md): A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform (CVSS 9.9, TPC Software Matchpoint)
- [CVE-2026-112910](https://cve.now/CVE-2026-112910.md): filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL (CVSS 5.3, tox-dev filelock · filelock)
- [CVE-2026-100395](https://cve.now/CVE-2026-100395.md): LXC: lxc-copy host-context hostname update follows symlink (CVSS 6.8, lxc)
- [CVE-2026-119757](https://cve.now/CVE-2026-119757.md): BTCPay Server \< 2.4.2 LND Macaroon Credential File Disclosure (CVSS 9.3, BTCPay Server)
- [CVE-2026-33944](https://cve.now/CVE-2026-33944.md): Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1\_value parameter (CVSS 8.8, dolibarr · dolibarr/dolibarr)
- [CVE-2026-111770](https://cve.now/CVE-2026-111770.md): Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another (CVSS 7.7, modelcontextprotocol typescript-sdk · @modelcontextprotocol…)
- [CVE-2026-111768](https://cve.now/CVE-2026-111768.md): Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (CVSS 7.5, modelcontextprotocol typescript-sdk · @modelcontextproto… +1)
- [CVE-2026-111769](https://cve.now/CVE-2026-111769.md): Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom… (CVSS 6.5, modelcontextprotocol typescript-sdk · @modelcontextproto… +1)
- [CVE-2026-111771](https://cve.now/CVE-2026-111771.md): Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service (CVSS 6.8, modelcontextprotocol typescript-sdk · @modelcontextproto… +3)
- [CVE-2026-49272](https://cve.now/CVE-2026-49272.md): OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow (CVSS 8.5, oauthlib)
- [CVE-2026-77463](https://cve.now/CVE-2026-77463.md): Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment (CVSS 6.5, umputun remark42)
- [CVE-2026-77622](https://cve.now/CVE-2026-77622.md): Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder (CVSS 8.2, BishopFox sliver)
- [CVE-2026-81190](https://cve.now/CVE-2026-81190.md): KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF (CVSS 6.9, kurrent-io KurrentDB)
- [CVE-2026-111062](https://cve.now/CVE-2026-111062.md): A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request (CVSS 2.3, Eugeny russh)
- [CVE-2026-48705](https://cve.now/CVE-2026-48705.md): MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) (CVSS 9.3, Project-MONAI MONAI · monai)
- [CVE-2026-110802](https://cve.now/CVE-2026-110802.md): Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox (CVSS 6.1, altair-graphql altair · altair-graphql altair-express-mi… +3)
- [CVE-2026-112902](https://cve.now/CVE-2026-112902.md): Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags (CVSS 8.3, python-pillow Pillow)
- [CVE-2026-114604](https://cve.now/CVE-2026-114604.md): GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments (CVSS 8.4, ardatan graphql-tools · @graphql-tools/utils)
- [CVE-2026-112899](https://cve.now/CVE-2026-112899.md): Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit (CVSS 6.3, python-pillow Pillow)
- [CVE-2026-54442](https://cve.now/CVE-2026-54442.md): NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF (CVSS 4.8, NationalSecurityAgency emissary · gov.nsa.emissary:emissary)
- [CVE-2026-62268](https://cve.now/CVE-2026-62268.md): borg extract might modify out-of-tree files when extracting maliciously crafted archives (CVSS 5.3, borgbackup borg)
- [CVE-2026-85076](https://cve.now/CVE-2026-85076.md): Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) (CVSS 9.0, jhuckaby Cronicle)
- [CVE-2026-34157](https://cve.now/CVE-2026-34157.md): Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins (CVSS 7.6, wailsapp wails · github.com/wailsapp/wails/v2)
- [CVE-2026-111753](https://cve.now/CVE-2026-111753.md): Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) (CVSS 5.9, angular)
- [CVE-2026-114134](https://cve.now/CVE-2026-114134.md): Black: GitHub Action installs unvalidated required-version from pyproject.toml (CVSS 8.7, psf black · black)
- [CVE-2026-46350](https://cve.now/CVE-2026-46350.md): dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS (CVSS 9.1, dcmjs-org dcmjs · dcmjs)
- [CVE-2026-119434](https://cve.now/CVE-2026-119434.md): Decompression bomb in ezstd:decompress\_using\_ddict/2 allows BEAM memory exhaustion via unbounded output buffer (CVSS 6.9, silviucpp ezstd · ezstd)
- [CVE-2026-55458](https://cve.now/CVE-2026-55458.md): Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through (CVSS 2.9, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-87008](https://cve.now/CVE-2026-87008.md): Code Graph RAG structural tools follow out-of-root symlinks (CVSS 7.1, vitali87 code-graph-rag)
- [CVE-2026-77604](https://cve.now/CVE-2026-77604.md): Code Graph RAG: MCP paginated read\_file path traversal / arbitrary file read (CVSS 7.5, vitali87 code-graph-rag)
- [CVE-2026-102940](https://cve.now/CVE-2026-102940.md): OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment (CVSS 9.6, openemr)
- [CVE-2026-103021](https://cve.now/CVE-2026-103021.md): OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading (CVSS 5.3, openemr)
- [CVE-2026-103020](https://cve.now/CVE-2026-103020.md): OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions (CVSS 5.3, openemr)
- [CVE-2026-103019](https://cve.now/CVE-2026-103019.md): OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint (CVSS 4.3, openemr)
- [CVE-2026-104134](https://cve.now/CVE-2026-104134.md): OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email) (CVSS 6.5, openemr)
- [CVE-2026-103939](https://cve.now/CVE-2026-103939.md): OpenEMR: Weno \`file\_download.php\`: missing ACL/CSRF truncates the e-prescribing pharmacy directory (CVSS 5.4, openemr)
- [CVE-2026-104138](https://cve.now/CVE-2026-104138.md): OpenEMR: Missing authorization on QRDA Category I/III download endpoints (CVSS 6.5, openemr)
- [CVE-2026-115573](https://cve.now/CVE-2026-115573.md): OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration (CVSS 8.1, openemr)
- [CVE-2026-104133](https://cve.now/CVE-2026-104133.md): OpenEMR: Missing authorization in DORN \`compendium\_install.php\` — non-admin destructive lab-compendium reinstall (CVSS 7.1, openemr)
- [CVE-2026-103935](https://cve.now/CVE-2026-103935.md): OpenEMR: Stored XSS via \`text()\` Misuse in Double-Quoted HTML Attribute (CVSS 8.1, openemr)
- [CVE-2026-104135](https://cve.now/CVE-2026-104135.md): OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth (CVSS 6.5, openemr)
- [CVE-2026-104136](https://cve.now/CVE-2026-104136.md): OpenEMR: Arbitrary Patient Recall and Contact Detail Read (CVSS 7.1, openemr)
- [CVE-2026-76181](https://cve.now/CVE-2026-76181.md): Heap buffer overflow in dBASE index import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-103938](https://cve.now/CVE-2026-103938.md): OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations (CVSS 7.1, openemr)
- [CVE-2026-104137](https://cve.now/CVE-2026-104137.md): OpenEMR: Patient Data Search Without Sufficient ACL (CVSS 7.1, openemr)
- [CVE-2026-110930](https://cve.now/CVE-2026-110930.md): Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. (CVSS 8.0, OpenAI Codex Desktop for Windows)
- [CVE-2026-104139](https://cve.now/CVE-2026-104139.md): OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI (CVSS 6.5, openemr)
- [CVE-2026-65983](https://cve.now/CVE-2026-65983.md): OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot (CVSS 7.5, openemr)
- [CVE-2026-18159](https://cve.now/CVE-2026-18159.md): A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking. (CVSS 5.3, OpenText Directory Services)
- [CVE-2026-116782](https://cve.now/CVE-2026-116782.md): FreeSWITCH: Pre-authentication invalid pointer dereference in mod\_rtmp connect command handling (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-116783](https://cve.now/CVE-2026-116783.md): FreeSWITCH mod\_spandsp: out-of-bounds write parsing UDPTL error-recovery data (CVSS 8.2, signalwire freeswitch)
- [CVE-2026-116790](https://cve.now/CVE-2026-116790.md): FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY (CVSS 9.1, signalwire freeswitch)
- [CVE-2026-76580](https://cve.now/CVE-2026-76580.md): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services… (CVSS 6.3, OpenText Directory Services)
- [CVE-2026-19134](https://cve.now/CVE-2026-19134.md): A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering. (CVSS 7.1, OpenText Directory Services)
- [CVE-2026-116788](https://cve.now/CVE-2026-116788.md): FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding (CVSS 8.2, signalwire freeswitch)
- [CVE-2026-116780](https://cve.now/CVE-2026-116780.md): FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via \`${variable:offset}\` slicing (CVSS 2.7, signalwire freeswitch)
- [CVE-2026-116784](https://cve.now/CVE-2026-116784.md): FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-116779](https://cve.now/CVE-2026-116779.md): FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands (CVSS 9.8, signalwire freeswitch)
- [CVE-2026-116789](https://cve.now/CVE-2026-116789.md): FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server (CVSS 7.4, signalwire freeswitch)
- [CVE-2026-116781](https://cve.now/CVE-2026-116781.md): FreeSWITCH: Pre-authentication out-of-bounds writes in mod\_xml\_rpc WebSocket frame parsing (CVSS 5.3, signalwire freeswitch)
- [CVE-2026-116785](https://cve.now/CVE-2026-116785.md): FreeSWITCH: Pre-authentication heap out-of-bounds write in mod\_xml\_rpc WebSocket frame length handling (CVSS 9.1, signalwire freeswitch)
- [CVE-2026-116786](https://cve.now/CVE-2026-116786.md): FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod\_sofia (CVSS 8.8, signalwire freeswitch)
- [CVE-2026-116787](https://cve.now/CVE-2026-116787.md): FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-116567](https://cve.now/CVE-2026-116567.md): FreeSWITCH: Pre-authentication stack buffer overflow in mod\_rtmp control-message handling (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-116571](https://cve.now/CVE-2026-116571.md): FreeSWITCH: Stack buffer overflow in mod\_rtmp AVC sequence-header construction (CVSS 5.9, signalwire freeswitch)
- [CVE-2026-116570](https://cve.now/CVE-2026-116570.md): FreeSWITCH: Pre-authentication stack buffer overflow in mod\_xml\_rpc HTTP directory authentication (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-116569](https://cve.now/CVE-2026-116569.md): FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-1339](https://cve.now/CVE-2026-1339.md): Open redirect vulnerability - UCMDB/Operations Bridge Manager (CVSS 5.1, OpenText Universal Discovery and CMDB · OpenText Operations…)
- [CVE-2026-116568](https://cve.now/CVE-2026-116568.md): FreeSWITCH: Out-of-bounds read in mod\_rtmp H.264 video message parsing (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-116572](https://cve.now/CVE-2026-116572.md): FreeSWITCH mod\_sofia: stack buffer overflow from an over-long SIP Contact display-name (CVSS 6.5, signalwire freeswitch)
- [CVE-2026-44875](https://cve.now/CVE-2026-44875.md): In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows… (CVSS 7.8, Hewlett Packard Enterprise (HPE) HPE Cray Programming Envir…)
- [CVE-2026-115928](https://cve.now/CVE-2026-115928.md): FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls (CVSS 7.5, signalwire freeswitch)
- [CVE-2026-116574](https://cve.now/CVE-2026-116574.md): FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences (CVSS 5.9, signalwire freeswitch)
- [CVE-2026-116573](https://cve.now/CVE-2026-116573.md): FreeSWITCH mod\_sofia: stack buffer overflow from an over-long SIP To-header user (CVSS 6.5, signalwire freeswitch)
- [CVE-2026-100358](https://cve.now/CVE-2026-100358.md): SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection (CVSS 9.4, SuiteCRM)
- [CVE-2026-100363](https://cve.now/CVE-2026-100363.md): SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration) (CVSS 8.8, SuiteCRM)
- [CVE-2026-100359](https://cve.now/CVE-2026-100359.md): SuiteCRM: Authenticated SQL Injection In action\_get\_end\_date function (CVSS 6.5, SuiteCRM)
- [CVE-2026-123273](https://cve.now/CVE-2026-123273.md): ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder (CVSS 7.1, ImageMagick)
- [CVE-2026-123272](https://cve.now/CVE-2026-123272.md): mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata (CVSS 5.1, mark3labs mcp-go)
- [CVE-2026-123271](https://cve.now/CVE-2026-123271.md): ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator (CVSS 5.1, diillson ChatCLI)
- [CVE-2026-123135](https://cve.now/CVE-2026-123135.md): langgenius dify Sandbox Run init.py hard-coded credentials (CVSS 5.3, langgenius dify)
- [CVE-2026-100362](https://cve.now/CVE-2026-100362.md): SuiteCRM: V8 OAuth2 Username Enumeration (CVSS 6.9, SuiteCRM)
- [CVE-2026-97377](https://cve.now/CVE-2026-97377.md): SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal\_get\_entry\_list (CVSS 8.8, SuiteCRM)
- [CVE-2026-100360](https://cve.now/CVE-2026-100360.md): SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record (CVSS 7.1, SuiteCRM)
- [CVE-2026-100361](https://cve.now/CVE-2026-100361.md): SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user\_hash, external\_auth\_only) (CVSS 7.1, SuiteCRM)
- [CVE-2026-100364](https://cve.now/CVE-2026-100364.md): SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack (CVSS 7.1, SuiteCRM)
- [CVE-2026-100365](https://cve.now/CVE-2026-100365.md): SuiteCRM: Time-Based Blind SQL Injection via AOR\_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User (CVSS 8.8, SuiteCRM)
- [CVE-2026-71548](https://cve.now/CVE-2026-71548.md): SuiteCRM: Authenticated SQL Injection in AOR\_Reports \`parameter\_value\` (value\_type=Field) allows any low-privileged user to read the full… (CVSS 8.8, SuiteCRM)
- [CVE-2026-71550](https://cve.now/CVE-2026-71550.md): SuiteCRM: LFI to RCE via AOW\_WorkFlow (CVSS 9.9, SuiteCRM)
- [CVE-2026-69134](https://cve.now/CVE-2026-69134.md): SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management (CVSS 8.8, SuiteCRM)
- [CVE-2026-69141](https://cve.now/CVE-2026-69141.md): SuiteCRM: SQL injection via search param in modules/Cases/controller.php (CVSS 8.3, SuiteCRM)
- [CVE-2026-69142](https://cve.now/CVE-2026-69142.md): SuiteCRM: Authenticated SQL Injection in map\_markers distance Parameter (CVSS 8.8, SuiteCRM)
- [CVE-2026-69140](https://cve.now/CVE-2026-69140.md): SuiteCRM: SQL injection via get\_latest\_for\_id param in GetLatestRevision.php (CVSS 8.3, SuiteCRM)
- [CVE-2026-69145](https://cve.now/CVE-2026-69145.md): SuiteCRM: AOR Reports aor\_fields.field SQL Injection (CVSS 6.5, SuiteCRM)
- [CVE-2026-69136](https://cve.now/CVE-2026-69136.md): SuiteCRM: Authenticated SQL Injection In handleAttachments function (CVSS 7.1, SuiteCRM)
- [CVE-2026-69135](https://cve.now/CVE-2026-69135.md): SuiteCRM: Authenticated SQL Injection In Project Module (CVSS 7.1, SuiteCRM)
- [CVE-2026-69144](https://cve.now/CVE-2026-69144.md): SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php (CVSS 6.5, SuiteCRM)
- [CVE-2026-69137](https://cve.now/CVE-2026-69137.md): SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure (CVSS 7.7, SuiteCRM)
- [CVE-2026-61648](https://cve.now/CVE-2026-61648.md): SuiteCRM: SQL injection via parameter\_value\[0\] param in AOR\_Report.php (CVSS 8.3, SuiteCRM)
- [CVE-2026-61650](https://cve.now/CVE-2026-61650.md): SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization (CVSS 8.1, SuiteCRM)
- [CVE-2026-61653](https://cve.now/CVE-2026-61653.md): SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php (CVSS 8.3, SuiteCRM)
- [CVE-2026-63213](https://cve.now/CVE-2026-63213.md): SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM (CVSS 7.2, SuiteCRM)
- [CVE-2026-123208](https://cve.now/CVE-2026-123208.md): noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server (CVSS 7.7, libnoname noname)
- [CVE-2026-123207](https://cve.now/CVE-2026-123207.md): LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding (CVSS 2.3, LibreSpark LibreTV)
- [CVE-2026-123206](https://cve.now/CVE-2026-123206.md): EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key (CVSS 6.3, aozorae EdgeChat)
- [CVE-2026-123205](https://cve.now/CVE-2026-123205.md): accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log\_tcp/log\_syslog/log\_pgsql (CVSS 8.3, accel-ppp)
- [CVE-2026-123204](https://cve.now/CVE-2026-123204.md): Posta before v0.18.0 SSRF via Webhook URL (CVSS 5.3, goposta posta)
- [CVE-2026-123203](https://cve.now/CVE-2026-123203.md): NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens (CVSS 6.9, neuronsimulator NEURON)
- [CVE-2026-123202](https://cve.now/CVE-2026-123202.md): libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name (CVSS 8.7, bakulf libnxml)
- [CVE-2026-123201](https://cve.now/CVE-2026-123201.md): buku through 5.1.1 SSRF via bukuserver fetch\_data and network\_handle API (CVSS 6.3, jarun buku)
- [CVE-2026-123200](https://cve.now/CVE-2026-123200.md): VRPN through 07.36 Out-of-bounds Write via SENDER\_DESCRIPTION/TYPE\_DESCRIPTION length index (CVSS 8.7, VRPN)
- [CVE-2026-123199](https://cve.now/CVE-2026-123199.md): eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute (CVSS 6.8, book-readers eBook-speaker)
- [CVE-2026-123198](https://cve.now/CVE-2026-123198.md): LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/\<ID\> (CVSS 9.3, LMFDB)
- [CVE-2026-123197](https://cve.now/CVE-2026-123197.md): WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files (CVSS 6.9, wppconnect-server)
- [CVE-2026-123196](https://cve.now/CVE-2026-123196.md): Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata (CVSS 8.6, authorizerdev authorizer)
- [CVE-2026-61649](https://cve.now/CVE-2026-61649.md): SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services (CVSS 7.7, SuiteCRM)
- [CVE-2026-63215](https://cve.now/CVE-2026-63215.md): SuiteCRM: Time-Based Blind SQL Injection via REST API (CVSS 8.3, SuiteCRM)
- [CVE-2026-116472](https://cve.now/CVE-2026-116472.md): ingress-nginx mirror-target self-DOS (CVSS 2.7, Kubernetes ingress-nginx · SUSE Rancher Prime RKE2 ingress-…)
- [CVE-2026-63217](https://cve.now/CVE-2026-63217.md): SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration (CVSS 6.5, SuiteCRM)
- [CVE-2026-94395](https://cve.now/CVE-2026-94395.md): Stack-based buffer overflow in SafeNet Authentication Client SIS token engine (CVSS 7.0, Thalesgroup Safenet Authentication Client SIS token engine)
- [CVE-2026-63214](https://cve.now/CVE-2026-63214.md): SuiteCRM: Authenticated SQL Injection in v4\_1 get\_entry\_list rest api (CVSS 8.8, SuiteCRM)
- [CVE-2026-63218](https://cve.now/CVE-2026-63218.md): SuiteCRM: Record-level Authorization Bypass via AOR\_Reports changeReportPage (CVSS 6.5, SuiteCRM)
- [CVE-2026-61651](https://cve.now/CVE-2026-61651.md): SuiteCRM: Authenticated SQL Injection in get\_end\_date function in Project Controller (CVSS 8.3, SuiteCRM)
- [CVE-2026-63111](https://cve.now/CVE-2026-63111.md): SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron (CVSS 7.1, SuiteCRM)
- [CVE-2026-115451](https://cve.now/CVE-2026-115451.md): Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15… (CVSS 6.9, tassos.gr Advanced Custom Fields extension for Joomla · tas…)
- [CVE-2026-118494](https://cve.now/CVE-2026-118494.md): Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 (CVSS 8.2, jreviews.com JReviews component for Joomla)
- [CVE-2026-107129](https://cve.now/CVE-2026-107129.md): Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox \< 2.20.5.0 (CVSS 8.3, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-107130](https://cve.now/CVE-2026-107130.md): Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox \< 2.20.5.0 (CVSS 6.9, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-107903](https://cve.now/CVE-2026-107903.md): Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox \< 2.20.5.0 (CVSS 8.6, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-105607](https://cve.now/CVE-2026-105607.md): Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox \< 2.20.5.0 (CVSS 8.6, balbooa.com Gridbox extension for Joomla)
- [CVE-2026-115452](https://cve.now/CVE-2026-115452.md): Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9… (CVSS 7.5, tassos.gr Advanced Custom Fields extension for Joomla · tas…)
- [CVE-2026-121949](https://cve.now/CVE-2026-121949.md): Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass (CVSS 2.3, sensiolabs symfony/html-sanitizer)
- [CVE-2026-123184](https://cve.now/CVE-2026-123184.md): Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes (CVSS 7.2, Altium)
- [CVE-2026-107359](https://cve.now/CVE-2026-107359.md): Malformed Wi-Fi Beacon Causes Crash on WF200 (CVSS 7.1, Silicon Labs WF200 FW)
- [CVE-2026-112110](https://cve.now/CVE-2026-112110.md): Privileged file deletion in SafeNet Authentication Client SACSrv (CVSS 5.8, Thalesgroup Safenet Authentication Client Service)
- [CVE-2026-102927](https://cve.now/CVE-2026-102927.md): HedgeDoc: Missing validation of incoming permission values on change (CVSS 5.9, hedgedoc)
- [CVE-2026-54912](https://cve.now/CVE-2026-54912.md): WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch (CVSS 8.8, bytecodealliance wasm-micro-runtime)
- [CVE-2026-54913](https://cve.now/CVE-2026-54913.md): WebAssembly Micro Runtime: Missing \`ref.null\` heap-type validation in \`load\_init\_expr\` leaks host stack memory to the WebAssembly guest (CVSS 6.9, bytecodealliance wasm-micro-runtime)
- [CVE-2026-54914](https://cve.now/CVE-2026-54914.md): WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll\_oneoff Output Buffer (CVSS 8.3, bytecodealliance wasm-micro-runtime)
- [CVE-2026-77439](https://cve.now/CVE-2026-77439.md): Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints (CVSS 8.8, immich-app immich)
- [CVE-2026-112109](https://cve.now/CVE-2026-112109.md): Local privilege escalation in SafeNet Authentication Client SACSrv (CVSS 7.3, Thalesgroup Safenet Authentication Client Service)
- [CVE-2026-97847](https://cve.now/CVE-2026-97847.md): Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain… (CVSS 7.1, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-97175](https://cve.now/CVE-2026-97175.md): Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover (CVSS 8.8, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-97174](https://cve.now/CVE-2026-97174.md): Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens (CVSS 6.8, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-96453](https://cve.now/CVE-2026-96453.md): Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates (CVSS 8.0, Red Hat AMQ Broker · Red Hat Build of Keycloak +4)
- [CVE-2026-93998](https://cve.now/CVE-2026-93998.md): Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer (CVSS 7.4, Red Hat AMQ Broker · Red Hat Build of Keycloak +4)
- [CVE-2026-92857](https://cve.now/CVE-2026-92857.md): Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed… (CVSS 8.1, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-92855](https://cve.now/CVE-2026-92855.md): Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession (CVSS 7.4, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-120859](https://cve.now/CVE-2026-120859.md): PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files (CVSS 8.5, PyMoDAQ · pymodaq\_data +2)
- [CVE-2026-82965](https://cve.now/CVE-2026-82965.md): Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing (CVSS 7.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-104867](https://cve.now/CVE-2026-104867.md): Immich calendar heatmap endpoint discloses cross-user activity through broken access control (CVSS 4.3, immich-app immich)
- [CVE-2026-120499](https://cve.now/CVE-2026-120499.md): h5io before 0.2.6 Arbitrary Code Execution via read\_hdf5 (CVSS 8.5, h5io)
- [CVE-2026-76077](https://cve.now/CVE-2026-76077.md): ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT() (CVSS 8.1, esa asn1scc)
- [CVE-2026-75615](https://cve.now/CVE-2026-75615.md): ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders (CVSS 5.3, esa asn1scc)
- [CVE-2026-75614](https://cve.now/CVE-2026-75614.md): ASN1SCC: Out-of-bounds write in BitStream\_DecodeConstraintWholeNumber (uPER/ACN) (CVSS 8.1, esa asn1scc)
- [CVE-2026-49407](https://cve.now/CVE-2026-49407.md): OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth (CVSS 7.7, tinyhumansai openhuman)
- [CVE-2026-54142](https://cve.now/CVE-2026-54142.md): OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval (CVSS 8.7, tinyhumansai openhuman)
- [CVE-2026-54146](https://cve.now/CVE-2026-54146.md): OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive) (CVSS 8.8, tinyhumansai openhuman)
- [CVE-2026-54143](https://cve.now/CVE-2026-54143.md): OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution (CVSS 9.8, tinyhumansai openhuman)
- [CVE-2026-54141](https://cve.now/CVE-2026-54141.md): OpenHuman: Yuanbao non-web channel can bypass human approval to execute \`node\_exec\` (CVSS 9.0, tinyhumansai openhuman)
- [CVE-2026-119083](https://cve.now/CVE-2026-119083.md): GluonTS arbitrary file write during archive extraction (CVSS 7.8, AWS gluonts)
- [CVE-2026-49393](https://cve.now/CVE-2026-49393.md): OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token (CVSS 8.4, tinyhumansai openhuman)
- [CVE-2026-54145](https://cve.now/CVE-2026-54145.md): OpenHuman: Bearer token leaked via approval gate session\_id (SQLite plaintext + debug log + RPC response) (CVSS 8.8, tinyhumansai openhuman)
- [CVE-2026-49405](https://cve.now/CVE-2026-49405.md): OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data (CVSS 6.2, tinyhumansai openhuman)
- [CVE-2026-111253](https://cve.now/CVE-2026-111253.md): Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved… (CVSS 6.6, Red Hat Hardened Images)
- [CVE-2026-118517](https://cve.now/CVE-2026-118517.md): Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for… (CVSS 2.3, sensiolabs symfony/http-client)
- [CVE-2026-54144](https://cve.now/CVE-2026-54144.md): OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture (CVSS 6.1, tinyhumansai openhuman)
- [CVE-2026-54140](https://cve.now/CVE-2026-54140.md): OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization (CVSS 8.3, tinyhumansai openhuman)
- [CVE-2026-102739](https://cve.now/CVE-2026-102739.md): ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution (CVSS 7.8, francescopace espectre)
- [CVE-2026-123151](https://cve.now/CVE-2026-123151.md): Gdb: gdb: stack buffer overflow in parse\_tsv\_definition via stale rs-\>buf tail (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-121997](https://cve.now/CVE-2026-121997.md): Gdb: gdbserver: heap buffer overflow in cmd\_qtdpsrc via qtdpsrc declared/actual length mismatch (CVSS 8.1, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-121996](https://cve.now/CVE-2026-121996.md): Gdb: gdbserver: heap disclosure and wild pointer in gdb\_parse\_agent\_expr via untrusted agent-expression length (CVSS 8.2, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-121995](https://cve.now/CVE-2026-121995.md): Gdb: gdb: stack buffer overflow in parse\_tracepoint\_definition via stale rs-\>buf tail (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-121994](https://cve.now/CVE-2026-121994.md): Gdb: gdb: stack buffer overflow in fetch\_register\_using\_p via unchecked p-reply length (CVSS 8.8, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-97371](https://cve.now/CVE-2026-97371.md): ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets (CVSS 5.3, ntopng)
- [CVE-2026-114232](https://cve.now/CVE-2026-114232.md): Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access (CVSS 8.1, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-112208](https://cve.now/CVE-2026-112208.md): Keycloak-services: keycloak-services: account takeover via stale sso\_auth note in organization identity-first login (CVSS 8.1, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-110932](https://cve.now/CVE-2026-110932.md): Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache (CVSS 7.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-110931](https://cve.now/CVE-2026-110931.md): Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop (CVSS 7.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-107602](https://cve.now/CVE-2026-107602.md): Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop (CVSS 7.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-103112](https://cve.now/CVE-2026-103112.md): Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path (CVSS 7.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-107123](https://cve.now/CVE-2026-107123.md): Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing (CVSS 7.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-82413](https://cve.now/CVE-2026-82413.md): ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan \`scan\_ports\` parameter (\`nmap\` argument reaches \`popen\`) (CVSS 8.8, ntopng)
- [CVE-2026-85287](https://cve.now/CVE-2026-85287.md): HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service (CVSS 6.5, sysadminsmedia homebox)
- [CVE-2026-75599](https://cve.now/CVE-2026-75599.md): HomeBox: Stored XSS via \`javascript:\` URI in Custom Entity Fields (CVSS 5.4, sysadminsmedia homebox)
- [CVE-2026-85286](https://cve.now/CVE-2026-85286.md): HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay (CVSS 3.7, sysadminsmedia homebox)
- [CVE-2026-119344](https://cve.now/CVE-2026-119344.md): Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks (CVSS 9.1, ultravioletrs cocos)
- [CVE-2026-123125](https://cve.now/CVE-2026-123125.md): Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass (CVSS 6.3, sensiolabs symfony/validator)
- [CVE-2026-119345](https://cve.now/CVE-2026-119345.md): Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks (CVSS 7.2, ultravioletrs cocos)
- [CVE-2026-104269](https://cve.now/CVE-2026-104269.md): ModSecurity: RFC 2231 \`filename\*\` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java) (CVSS 8.6, owasp-modsecurity ModSecurity)
- [CVE-2026-73856](https://cve.now/CVE-2026-73856.md): ModSecurity: Response Body Inspection Bypass (CVSS 8.6, owasp-modsecurity ModSecurity)
- [CVE-2026-61813](https://cve.now/CVE-2026-61813.md): ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download (CVSS 3.7, owasp-modsecurity ModSecurity)
- [CVE-2026-123158](https://cve.now/CVE-2026-123158.md): sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass… (CVSS 8.1, OpenBSD OpenSSH)
- [CVE-2026-103932](https://cve.now/CVE-2026-103932.md): ModSecurity: PCRE2 \`@rxGlobal\` match-limit errors are converted to no-match (CVSS 5.8, owasp-modsecurity ModSecurity)
- [CVE-2026-119751](https://cve.now/CVE-2026-119751.md): Content Egg WordPress Plugin \< 12.1.0 Unauthenticated Information Disclosure via render-blocks (CVSS 6.9, keywordrush Content Egg – Affiliate Product Importer & Pric…)
- [CVE-2026-102615](https://cve.now/CVE-2026-102615.md): HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS (CVSS 7.6, heyform)
- [CVE-2026-102523](https://cve.now/CVE-2026-102523.md): MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION (CVSS 8.0, MariaDB server)
- [CVE-2026-70660](https://cve.now/CVE-2026-70660.md): stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data\_offsets allow a tensor's byte range to extend past the… (CVSS 6.9, leejet stable-diffusion.cpp)
- [CVE-2026-70659](https://cve.now/CVE-2026-70659.md): stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (\`load\_imatrix\`) via a duplicate tensor name (CVSS 7.8, leejet stable-diffusion.cpp)
- [CVE-2026-115740](https://cve.now/CVE-2026-115740.md): Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix… (CVSS 5.3, Trellix DLP on-prem extensions)
- [CVE-2026-121139](https://cve.now/CVE-2026-121139.md): Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication (CVSS 7.3, Rapid7 Metasploit Framework)
- [CVE-2026-107891](https://cve.now/CVE-2026-107891.md): musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to… (CVSS 8.1, musl -libc musl)
- [CVE-2026-115739](https://cve.now/CVE-2026-115739.md): Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to… (CVSS 6.0, Trellix DLP on-prem extensions)
- [CVE-2026-123096](https://cve.now/CVE-2026-123096.md): anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response (CVSS 7.1, anacrolix torrent)
- [CVE-2026-123095](https://cve.now/CVE-2026-123095.md): mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl\_hook Newlines (CVSS 7.7, mpv-player mpv)
- [CVE-2026-123094](https://cve.now/CVE-2026-123094.md): Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name (CVSS 5.1, huginn)
- [CVE-2026-122330](https://cve.now/CVE-2026-122330.md): Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2\_schunk\_get\_slice\_buffer() (CVSS 6.8, c-blosc2)
- [CVE-2026-122329](https://cve.now/CVE-2026-122329.md): SDL\_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder (CVSS 8.5, libsdl-org SDL\_mixer)
- [CVE-2026-122328](https://cve.now/CVE-2026-122328.md): SDL\_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder (CVSS 8.5, libsdl-org SDL\_mixer)
- [CVE-2026-122327](https://cve.now/CVE-2026-122327.md): Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints (CVSS 5.3, Arthi-chaud Meelo)
- [CVE-2026-122326](https://cve.now/CVE-2026-122326.md): Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents (CVSS 6.9, Chevereto)
- [CVE-2026-122325](https://cve.now/CVE-2026-122325.md): eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API (CVSS 2.3, fossasia eventyay-exhibition)
- [CVE-2026-122324](https://cve.now/CVE-2026-122324.md): SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails (CVSS 2.3, oss-apps SplitPro)
- [CVE-2026-122317](https://cve.now/CVE-2026-122317.md): SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query (CVSS 5.3, oss-apps SplitPro)
- [CVE-2026-115738](https://cve.now/CVE-2026-115738.md): SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL… (CVSS 7.1, Trellix DLP on-prem extensions)
- [CVE-2026-119744](https://cve.now/CVE-2026-119744.md): Cendio ThinLinc Improper Authentication via Web Access (CVSS 7.7, Cendio ThinLinc)
- [CVE-2026-123032](https://cve.now/CVE-2026-123032.md): OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication (CVSS 6.9, OpenBMB Internet of Agents)
- [CVE-2026-66903](https://cve.now/CVE-2026-66903.md): Apache OFBiz: Authenticated Path Traversal in Catalog Image Management (CVSS 6.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-71901](https://cve.now/CVE-2026-71901.md): Apache OFBiz: Dispatch arbitrary internal services on SFA component (CVSS 8.1, Apache Software Foundation Apache OFBiz)
- [CVE-2026-68524](https://cve.now/CVE-2026-68524.md): Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-64860](https://cve.now/CVE-2026-64860.md): espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression (CVSS 6.5, espressif esp-protocols)
- [CVE-2026-73577](https://cve.now/CVE-2026-73577.md): Apache OFBiz: Unauthenticated path-suffix view authorization bypass (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-73578](https://cve.now/CVE-2026-73578.md): Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-73580](https://cve.now/CVE-2026-73580.md): Apache OFBiz: Unauthenticated HR organization and employee disclosure (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-74841](https://cve.now/CVE-2026-74841.md): Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-76150](https://cve.now/CVE-2026-76150.md): Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-81734](https://cve.now/CVE-2026-81734.md): Apache OFBiz: Missing authorization - catalog quick-admin product writes (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-76152](https://cve.now/CVE-2026-76152.md): Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-81744](https://cve.now/CVE-2026-81744.md): Apache OFBiz: Authorization bypass - self-grant content OWNER (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-81808](https://cve.now/CVE-2026-81808.md): Apache OFBiz: Missing authorization - search-result bulk catalog mutation (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-81815](https://cve.now/CVE-2026-81815.md): Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-81816](https://cve.now/CVE-2026-81816.md): Apache OFBiz: XML external entity injection (XXE) (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-81828](https://cve.now/CVE-2026-81828.md): Apache OFBiz: Server-side request forgery in SurveyWrapper (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82894](https://cve.now/CVE-2026-82894.md): Apache OFBiz: Content renderer runs a service name stored on the row (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82902](https://cve.now/CVE-2026-82902.md): Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile (CVSS 4.3, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82904](https://cve.now/CVE-2026-82904.md): Apache OFBiz: Unbounded multi-form row count from a parameter name (CVSS 7.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82907](https://cve.now/CVE-2026-82907.md): Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound (CVSS 9.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82910](https://cve.now/CVE-2026-82910.md): Apache OFBiz: renderLink compiles link parameters as FreeMarker source (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82912](https://cve.now/CVE-2026-82912.md): Apache OFBiz: Unsandboxed Groovy compiled from a service parameter (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82916](https://cve.now/CVE-2026-82916.md): Apache OFBiz: webtools xmldsdump exports any entity to any path (CVSS 7.1, Apache Software Foundation Apache OFBiz)
- [CVE-2026-82960](https://cve.now/CVE-2026-82960.md): Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-83538](https://cve.now/CVE-2026-83538.md): Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-123028](https://cve.now/CVE-2026-123028.md): itsourcecode Online Book Store admin\_edit.php sql injection (CVSS 6.9, itsourcecode Online Book Store)
- [CVE-2026-83542](https://cve.now/CVE-2026-83542.md): Apache OFBiz: Unauthenticated RCE via login-page widget injection (CVSS 9.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-84183](https://cve.now/CVE-2026-84183.md): Apache OFBiz: Content Manager VIEW-only RCE in updateLayout (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-84728](https://cve.now/CVE-2026-84728.md): Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login (CVSS 5.4, Apache Software Foundation Apache OFBiz)
- [CVE-2026-85627](https://cve.now/CVE-2026-85627.md): Apache OFBiz: Authenticated Code Execution Vulnerability (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-76563](https://cve.now/CVE-2026-76563.md): HTML Injection in Fileorbis (CVSS 6.1, Fileorbis Informatics Services Trade Fileorbis)
- [CVE-2026-92887](https://cve.now/CVE-2026-92887.md): Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-97355](https://cve.now/CVE-2026-97355.md): Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-123024](https://cve.now/CVE-2026-123024.md): agentscope-ai AgentScope Agent Service deps.py get\_current\_user\_id missing authentication (CVSS 6.9, agentscope-ai AgentScope)
- [CVE-2026-97356](https://cve.now/CVE-2026-97356.md): Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-100168](https://cve.now/CVE-2026-100168.md): Apache OFBiz: Missing Authorization vulnerability (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-100228](https://cve.now/CVE-2026-100228.md): Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-105325](https://cve.now/CVE-2026-105325.md): Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-105330](https://cve.now/CVE-2026-105330.md): Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-105461](https://cve.now/CVE-2026-105461.md): Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-109129](https://cve.now/CVE-2026-109129.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-109837](https://cve.now/CVE-2026-109837.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-109856](https://cve.now/CVE-2026-109856.md): Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-109928](https://cve.now/CVE-2026-109928.md): Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-114229](https://cve.now/CVE-2026-114229.md): Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-114233](https://cve.now/CVE-2026-114233.md): Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-114235](https://cve.now/CVE-2026-114235.md): Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-114271](https://cve.now/CVE-2026-114271.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-114272](https://cve.now/CVE-2026-114272.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-114277](https://cve.now/CVE-2026-114277.md): Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2026-123023](https://cve.now/CVE-2026-123023.md): agentscope-ai AgentScope Bash Tool \_bash.py check\_permissions authorization (CVSS 6.9, agentscope-ai AgentScope)
- [CVE-2026-117691](https://cve.now/CVE-2026-117691.md): Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names (CVSS 9.1, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-107912](https://cve.now/CVE-2026-107912.md): Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw (CVSS 7.7, Red Hat Exploit Intelligence · Red Hat OpenShift Serverl… +8)
- [CVE-2026-123022](https://cve.now/CVE-2026-123022.md): agentscope-ai AgentScope MCP Workspace API \_config.py subprocess.Popen os command injection (CVSS 6.9, agentscope-ai AgentScope)
- [CVE-2026-105321](https://cve.now/CVE-2026-105321.md): SQL Injection in Kobikom Telecommunications' Kobikom (CVSS 7.5, Kobikom Telecommunications and Informatics Services Kobikom)
- [CVE-2026-123059](https://cve.now/CVE-2026-123059.md): Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts (CVSS 7.5, Eclipse Foundation Eclipse BaSyx Helm Charts)
- [CVE-2026-104720](https://cve.now/CVE-2026-104720.md): Path Traversal in Kobikom Telecommunications' Kobikom (CVSS 7.5, Kobikom Telecommunications and Informatics Services Kobikom)
- [CVE-2026-123119](https://cve.now/CVE-2026-123119.md): Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports… (CVSS 2.3, sensiolabs symfony/http-client)
- [CVE-2026-123020](https://cve.now/CVE-2026-123020.md): eosphoros-ai DB-GPT Jinja2 Template init.py FileBasedSkill.get\_prompt special elements in template engine (CVSS 5.3, eosphoros-ai DB-GPT)
- [CVE-2026-103866](https://cve.now/CVE-2026-103866.md): Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling (low (no CVSS), Apache Software Foundation Apache Sling Engine)
- [CVE-2026-103864](https://cve.now/CVE-2026-103864.md): Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization (low (no CVSS), Apache Software Foundation Apache Sling Engine)
- [CVE-2026-103863](https://cve.now/CVE-2026-103863.md): Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths (low (no CVSS), Apache Software Foundation Apache Sling Engine)
- [CVE-2026-95652](https://cve.now/CVE-2026-95652.md): Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter (CVSS 6.6, TÜBİTAK BİLGEM Software Technologies Research Institute par…)
- [CVE-2026-123047](https://cve.now/CVE-2026-123047.md): Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts (CVSS 7.5, Eclipse Foundation Eclipse BaSyx Helm Charts)
- [CVE-2026-123019](https://cve.now/CVE-2026-123019.md): eosphoros-ai DB-GPT HuggingFace Adapter hf\_adapter.py exec\_module inclusion of functionality from untrusted control sphere (CVSS 6.9, eosphoros-ai DB-GPT)
- [CVE-2026-121489](https://cve.now/CVE-2026-121489.md): Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-microse…)
- [CVE-2026-96677](https://cve.now/CVE-2026-96677.md): Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-marshall)
- [CVE-2026-73117](https://cve.now/CVE-2026-73117.md): Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73116](https://cve.now/CVE-2026-73116.md): Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-cl…)
- [CVE-2026-73101](https://cve.now/CVE-2026-73101.md): Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73100](https://cve.now/CVE-2026-73100.md): Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73099](https://cve.now/CVE-2026-73099.md): Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-rest-se…)
- [CVE-2026-73098](https://cve.now/CVE-2026-73098.md): Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing (CVSS 10.0, Apache Software Foundation org.apache.juneau:juneau-marshall)
- [CVE-2026-73095](https://cve.now/CVE-2026-73095.md): Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling (CVSS 8.7, Apache Software Foundation org.apache.juneau:juneau-marshal…)
- [CVE-2026-123018](https://cve.now/CVE-2026-123018.md): eosphoros-ai DB-GPT CodeAction code\_utils.py execute\_code code injection (CVSS 6.9, eosphoros-ai DB-GPT)
- [CVE-2026-123036](https://cve.now/CVE-2026-123036.md): A flaw was found in ansible-core. (CVSS 5.5, Red Hat ansible-core)
- [CVE-2026-118869](https://cve.now/CVE-2026-118869.md): An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on… (CVSS 8.8, SHIRASAGI Project SHIRASAGI)
- [CVE-2026-117679](https://cve.now/CVE-2026-117679.md): A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a… (CVSS 5.4, SHIRASAGI Project SHIRASAGI)
- [CVE-2026-112072](https://cve.now/CVE-2026-112072.md): vault-java-driver: stored deeply nested JSON kills every thread that reads it (CVSS 6.5, io.github.jopenlibs:vault-java-driver)
- [CVE-2026-109408](https://cve.now/CVE-2026-109408.md): vault-java-driver: SslConfig silently disables requested TLS verification (CVSS 7.4, io.github.jopenlibs:vault-java-driver)
- [CVE-2026-107776](https://cve.now/CVE-2026-107776.md): Dokan \< 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon (CVSS 2.2, Dokan)
- [CVE-2026-100109](https://cve.now/CVE-2026-100109.md): Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw\_create\_temporary\_user (CVSS 9.8, Security For WooCommerce)
- [CVE-2026-123033](https://cve.now/CVE-2026-123033.md): Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their… (CVSS 8.3, iXsystems TrueNAS SCALE)
- [CVE-2026-123029](https://cve.now/CVE-2026-123029.md): Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the… (CVSS 7.5, Wowza Streaming Engine)
- [CVE-2026-123025](https://cve.now/CVE-2026-123025.md): An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin… (CVSS 9.4, OPNsense os-acme-client)
- [CVE-2026-123017](https://cve.now/CVE-2026-123017.md): GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. (CVSS 6.5, GodotSteam)
- [CVE-2026-109150](https://cve.now/CVE-2026-109150.md): WP PageNavi Style \<= 1.4 - Stored XSS via CSRF (no CVSS, WP PageNavi Style)
- [CVE-2026-107787](https://cve.now/CVE-2026-107787.md): CatFolders \< 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf\_run\_merge (no CVSS, CatFolders)
- [CVE-2026-107786](https://cve.now/CVE-2026-107786.md): CatFolders \< 2.5.7 - Author+ SQLi via 'sortFile' Setting (no CVSS, CatFolders)
- [CVE-2026-107775](https://cve.now/CVE-2026-107775.md): Dokan \< 5.3.3 - Admin+ Cross-Site Vendor Activation (no CVSS, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-107774](https://cve.now/CVE-2026-107774.md): Dokan \< 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form (no CVSS, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-107773](https://cve.now/CVE-2026-107773.md): Dokan \< 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint (no CVSS, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-105971](https://cve.now/CVE-2026-105971.md): Car Dealer \<= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer\_single\_car\_ajax (no CVSS, Car Dealer (Dealership) and Vehicle sales)
- [CVE-2026-105259](https://cve.now/CVE-2026-105259.md): Easy Social Icons \< 4.0.3 - Author+ Stored XSS via SVG Upload (no CVSS, Easy Social Icons)
- [CVE-2026-100144](https://cve.now/CVE-2026-100144.md): IVPAY payments \<= 1.0.8 - Unauthenticated SQLi via 'payment\_id' Parameter (no CVSS, IVPAY payments)
- [CVE-2025-15702](https://cve.now/CVE-2025-15702.md): Cloud Blocks \<= 1.1.8 - Unauthenticated Stored XSS (no CVSS, Cloud Blocks)
- [CVE-2025-15701](https://cve.now/CVE-2025-15701.md): Easy Social Icons \< 4.0.3 - Admin+ Stored XSS via Icon Color Settings (no CVSS, Easy Social Icons)
- [CVE-2026-91049](https://cve.now/CVE-2026-91049.md): EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute (no CVSS, EWWW Image Optimizer)
- [CVE-2026-90967](https://cve.now/CVE-2026-90967.md): Essential Real Estate \< 5.3.5 - Customer+ Invoice PII Disclosure via IDOR (no CVSS, Essential Real Estate)
- [CVE-2026-90966](https://cve.now/CVE-2026-90966.md): Essential Real Estate \< 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere\_free\_package\_ajax (no CVSS, Essential Real Estate)
- [CVE-2026-90965](https://cve.now/CVE-2026-90965.md): Essential Real Estate \< 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure (no CVSS, Essential Real Estate)
- [CVE-2026-90964](https://cve.now/CVE-2026-90964.md): Essential Real Estate \< 5.3.5 - Unauthenticated Arbitrary Email Sending (no CVSS, Essential Real Estate)
- [CVE-2026-90963](https://cve.now/CVE-2026-90963.md): Essential Real Estate \< 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property\_print\_ajax (no CVSS, Essential Real Estate)
- [CVE-2026-88814](https://cve.now/CVE-2026-88814.md): YITH WooCommerce Gift Cards \< 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition (no CVSS, YITH WooCommerce Gift Cards)
- [CVE-2026-87856](https://cve.now/CVE-2026-87856.md): Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction Bypass (no CVSS, Subscriptions for WooCommerce)
- [CVE-2026-86795](https://cve.now/CVE-2026-86795.md): Community Events \< 1.6.0 - Unauthenticated Pending Events Disclosure via ajax\_admin\_event\_list (no CVSS, Community Events)
- [CVE-2026-86442](https://cve.now/CVE-2026-86442.md): WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR (no CVSS, WP Event Manager)
- [CVE-2026-85570](https://cve.now/CVE-2026-85570.md): Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure (no CVSS, Tutor LMS)
- [CVE-2026-85351](https://cve.now/CVE-2026-85351.md): FV Player \< 7.5.56.7212 - Contributor+ SSRF via Media Library Import (no CVSS, FV Flowplayer Video Player)
- [CVE-2026-85347](https://cve.now/CVE-2026-85347.md): FV Player \< 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption (no CVSS, FV Flowplayer Video Player)
- [CVE-2026-85346](https://cve.now/CVE-2026-85346.md): FV Player \< 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers (no CVSS, FV Flowplayer Video Player)
- [CVE-2026-19256](https://cve.now/CVE-2026-19256.md): All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force (no CVSS, All In One Login)
- [CVE-2026-16304](https://cve.now/CVE-2026-16304.md): WP Event Manager \< 3.4.2 - Subscriber+ Arbitrary Post Takeover via event\_organizer\_ids (no CVSS, WP Event Manager)
- [CVE-2026-123014](https://cve.now/CVE-2026-123014.md): iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary… (CVSS 8.7, iTerm2)
- [CVE-2026-123012](https://cve.now/CVE-2026-123012.md): In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a… (CVSS 7.1, Gogs · gogs.io/gogs)
- [CVE-2026-118193](https://cve.now/CVE-2026-118193.md): GiveWP \<= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor\_default\_user\_role' Parameter (CVSS 8.8, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2026-120533](https://cve.now/CVE-2026-120533.md): Redux Framework \<= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme\_opts Parameter via User Profile (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-104812](https://cve.now/CVE-2026-104812.md): Redux Framework \<= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi\_media' Field Array Key (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-116617](https://cve.now/CVE-2026-116617.md): Motors \<= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm\_dealer\_logo\_path' Parameter (CVSS 8.1, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-93389](https://cve.now/CVE-2026-93389.md): LiteSpeed Cache \<= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via… (CVSS 8.2, litespeedtech LiteSpeed Cache)
- [CVE-2026-120553](https://cve.now/CVE-2026-120553.md): Customer Reviews for WooCommerce \<= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides\_to\_show' Shortcode… (CVSS 6.4, ivole Customer Reviews for WooCommerce)
- [CVE-2026-123011](https://cve.now/CVE-2026-123011.md): STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded. (CVSS 4.2, STMicroelectronics st-mems-android-linux-sensors-hal)
- [CVE-2026-123010](https://cve.now/CVE-2026-123010.md): @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. (CVSS 7.2, twilio-labs netlify-okta-auth)
- [CVE-2026-122236](https://cve.now/CVE-2026-122236.md): OpenHands Landing missing authentication (CVSS 5.3, OpenHands)
- [CVE-2026-122191](https://cve.now/CVE-2026-122191.md): itsourcecode Airline Reservation System manage\_booked.php sql injection (CVSS 5.3, itsourcecode Airline Reservation System)
- [CVE-2026-122190](https://cve.now/CVE-2026-122190.md): SourceCodester Online Food Ordering System Category Management add\_category.php cross site scripting (CVSS 4.8, SourceCodester Online Food Ordering System)
- [CVE-2026-122189](https://cve.now/CVE-2026-122189.md): OpenPPL ppl.nn CUDA Optimizer opt\_graph.cc InitQuantization out-of-bounds (CVSS 5.3, OpenPPL ppl.nn)
- [CVE-2026-122188](https://cve.now/CVE-2026-122188.md): DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override\_config path traversal (CVSS 5.3, DeepGraphLearning KnowledgeGraphEmbedding)
- [CVE-2026-48173](https://cve.now/CVE-2026-48173.md): In the NAS message handler, improper validation of the length field in NAS message causes memory corruption (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-48174](https://cve.now/CVE-2026-48174.md): In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service… (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-35494](https://cve.now/CVE-2026-35494.md): In the baseband, memory corruption during NAS packet processing can cause a denial of service. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-48175](https://cve.now/CVE-2026-48175.md): Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. (CVSS 5.5, Samsung Semiconductor Exynos)
- [CVE-2026-48178](https://cve.now/CVE-2026-48178.md): Out of bound access in PPC due to race condition in global variable access (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-48186](https://cve.now/CVE-2026-48186.md): Improper handling of messages before AS security activation can cause unexpected behavior (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-68993](https://cve.now/CVE-2026-68993.md): A double free vulnerability in NPU driver due to improper pointer management (940) (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-68994](https://cve.now/CVE-2026-68994.md): A double free vulnerability in NPU driver due to improper pointer management (941) (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-48183](https://cve.now/CVE-2026-48183.md): Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-68984](https://cve.now/CVE-2026-68984.md): In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69005](https://cve.now/CVE-2026-69005.md): Integer overflow in NPU driver parameter processing due to insufficient bounds checking. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-68985](https://cve.now/CVE-2026-68985.md): In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes… (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69006](https://cve.now/CVE-2026-69006.md): Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69068](https://cve.now/CVE-2026-69068.md): Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory. (no CVSS, Samsung Semiconductor Exynos Modem)
- [CVE-2026-69025](https://cve.now/CVE-2026-69025.md): In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial… (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-68990](https://cve.now/CVE-2026-68990.md): In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially… (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-68991](https://cve.now/CVE-2026-68991.md): In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to… (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69002](https://cve.now/CVE-2026-69002.md): Incorrect authorization in Samsung framework services due to missing permission checks (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69066](https://cve.now/CVE-2026-69066.md): Memory corruption in GPU driver due to improper validation of VMID reservation. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69050](https://cve.now/CVE-2026-69050.md): Out-of-bounds memory access in a device driver due to improper resource state tracking. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69043](https://cve.now/CVE-2026-69043.md): In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-69044](https://cve.now/CVE-2026-69044.md): In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2025-66366](https://cve.now/CVE-2025-66366.md): Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-33965](https://cve.now/CVE-2026-33965.md): An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2025-66367](https://cve.now/CVE-2025-66367.md): Improper handling of NAS DLTransport messages may lead to a baseband crash. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2025-66368](https://cve.now/CVE-2025-66368.md): Incorrect handling of SDP payload leads to a Denial of Service (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-33958](https://cve.now/CVE-2026-33958.md): Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-33971](https://cve.now/CVE-2026-33971.md): In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service… (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-33969](https://cve.now/CVE-2026-33969.md): In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of… (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-33972](https://cve.now/CVE-2026-33972.md): In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-48179](https://cve.now/CVE-2026-48179.md): In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-48176](https://cve.now/CVE-2026-48176.md): A memory corruption vulnerability caused by improper validation of messages (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-35495](https://cve.now/CVE-2026-35495.md): In IMS stack, improper handling of SIP packets leads to Incorrect\_Access\_Control vulnerability (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-122992](https://cve.now/CVE-2026-122992.md): In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty… (CVSS 9.2, G4KLX DStarGateway)
- [CVE-2026-122160](https://cve.now/CVE-2026-122160.md): myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel\_PEFT inclusion of functionality from untrusted control sphere (CVSS 5.3, myshell-ai AIlice)
- [CVE-2026-122323](https://cve.now/CVE-2026-122323.md): Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression (CVSS 8.7, kyverno)
- [CVE-2026-122322](https://cve.now/CVE-2026-122322.md): Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression (CVSS 8.7, kyverno)
- [CVE-2026-122321](https://cve.now/CVE-2026-122321.md): Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass (CVSS 8.5, kyverno)
- [CVE-2026-122320](https://cve.now/CVE-2026-122320.md): Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone (CVSS 8.3, kyverno)
- [CVE-2026-122319](https://cve.now/CVE-2026-122319.md): Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic (CVSS 8.7, kyverno)
- [CVE-2026-122318](https://cve.now/CVE-2026-122318.md): Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates (CVSS 7.2, kyverno)
- [CVE-2026-122316](https://cve.now/CVE-2026-122316.md): Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting (CVSS 8.4, kyverno)
- [CVE-2026-122315](https://cve.now/CVE-2026-122315.md): Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic (CVSS 8.7, kyverno)
- [CVE-2026-122314](https://cve.now/CVE-2026-122314.md): Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic (CVSS 8.7, kyverno)
- [CVE-2026-122313](https://cve.now/CVE-2026-122313.md): Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy (CVSS 9.4, kyverno)
- [CVE-2026-122312](https://cve.now/CVE-2026-122312.md): Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String (CVSS 8.3, kyverno)
- [CVE-2026-122311](https://cve.now/CVE-2026-122311.md): Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument (CVSS 9.4, kyverno)
- [CVE-2026-122310](https://cve.now/CVE-2026-122310.md): Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath (CVSS 9.4, kyverno)
- [CVE-2026-122309](https://cve.now/CVE-2026-122309.md): Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost (CVSS 8.2, kyverno)
- [CVE-2026-122308](https://cve.now/CVE-2026-122308.md): Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest (CVSS 8.4, kyverno)
- [CVE-2026-122307](https://cve.now/CVE-2026-122307.md): Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling (CVSS 8.3, kyverno)
- [CVE-2026-122306](https://cve.now/CVE-2026-122306.md): Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching (CVSS 8.3, kyverno)
- [CVE-2026-122305](https://cve.now/CVE-2026-122305.md): Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop (CVSS 8.3, kyverno)
- [CVE-2026-122304](https://cve.now/CVE-2026-122304.md): Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader (CVSS 9.4, kyverno)
- [CVE-2026-122303](https://cve.now/CVE-2026-122303.md): Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy (CVSS 9.4, kyverno)
- [CVE-2026-122302](https://cve.now/CVE-2026-122302.md): Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check (CVSS 9.3, kyverno)
- [CVE-2026-122301](https://cve.now/CVE-2026-122301.md): Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response (CVSS 2.3, parse-community parse-server)
- [CVE-2025-66365](https://cve.now/CVE-2025-66365.md): Incorrect handling of SIP packets leads to baseband crashes (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-122159](https://cve.now/CVE-2026-122159.md): Edge0-AI Audio8\_TTS Model Path Resolution runtime.py ArkTtsRuntime.init path traversal (CVSS 5.3, Edge0-AI Audio8\_TTS)
- [CVE-2026-122158](https://cve.now/CVE-2026-122158.md): InvoiceShelf MemberService.php create access control (CVSS 5.1, InvoiceShelf)
- [CVE-2026-122157](https://cve.now/CVE-2026-122157.md): Purocean Yank Note Terminal index.ts checkPermission os command injection (CVSS 5.3, Purocean Yank Note)
- [CVE-2025-66364](https://cve.now/CVE-2025-66364.md): Continuously sending control‑plane messages causes the baseband to crashes. (no CVSS, Samsung Semiconductor Exynos)
- [CVE-2026-122154](https://cve.now/CVE-2026-122154.md): purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure (CVSS 6.9, purocean Yank Note)
- [CVE-2026-122151](https://cve.now/CVE-2026-122151.md): Presenton User Configuration user-config JSON.parse cross-site request forgery (CVSS 5.3, Presenton)
- [CVE-2026-122146](https://cve.now/CVE-2026-122146.md): 101arrowz fflate index.mjs unzipSync memory corruption (CVSS 6.9, 101arrowz fflate)
- [CVE-2026-109849](https://cve.now/CVE-2026-109849.md): Incorrect privilege assignment issue exists in Hinemos. (CVSS 6.5, NTT DATA INTELLILINK Hinemos)
- [CVE-2026-122144](https://cve.now/CVE-2026-122144.md): nliautaud pico-content-editor cross-site request forgery (CVSS 5.3, nliautaud pico-content-editor)
- [CVE-2026-122052](https://cve.now/CVE-2026-122052.md): laspy LAS File lasreader.py memory allocation (CVSS 5.3, laspy)
- [CVE-2026-106713](https://cve.now/CVE-2026-106713.md): An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… (no CVSS)
- [CVE-2026-106714](https://cve.now/CVE-2026-106714.md): Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid… (no CVSS)
- [CVE-2026-106715](https://cve.now/CVE-2026-106715.md): NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. (no CVSS)
- [CVE-2026-106716](https://cve.now/CVE-2026-106716.md): ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView… (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.