# CVEs published 2026-11-06

462 CVEs were published on November 6, 2026: 42 critical, 142 high. 1 is now in CISA KEV. 7 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-246617fa60](https://cve.now/SZB-246617fa60): WorkOS says AI hacking agent breached internal sales app and accessed customer data
- [SZB-659381b7e7](https://cve.now/SZB-659381b7e7): CISA adds SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to KEV catalog
- [SZB-b323ce2f22](https://cve.now/SZB-b323ce2f22): OpenAI says its GPT-6 Cyber model found 81 unknown Firefox flaws
- [SZB-25aea6b559](https://cve.now/SZB-25aea6b559): QNAP says hackers are exploiting Plex2Shell vulnerability chain on NAS devices
- [SZB-0f0221e743](https://cve.now/SZB-0f0221e743): Microsoft Paint RCE flaw CVE-2026-83844 fixed via Store update, not Windows Update
- [SZB-fa6a588ebd](https://cve.now/SZB-fa6a588ebd): Chainalysis says attack exposed user credentials and live tokens
- [SZB-97fd8de188](https://cve.now/SZB-97fd8de188): QiAnXin XLab reports Linux backdoor hidden in Control Web Panel web server

## CVEs

- [CVE-2026-71881](https://cve.now/CVE-2026-71881.md): Cross-site scripting in Integrated Publishing Toolkit (CVSS 4.8, GBIF Integrated Publishing Toolkit)
- [CVE-2026-109469](https://cve.now/CVE-2026-109469.md): Entra Device Registration Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Entra Device Registration)
- [CVE-2026-118786](https://cve.now/CVE-2026-118786.md): NXP MCUXpresso SDK rpmsg-lite TZM Example before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions (CVSS 6.8, NXP MCUXpresso SDK)
- [CVE-2026-118785](https://cve.now/CVE-2026-118785.md): NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions (CVSS 6.7, NXP MCUXpresso SDK)
- [CVE-2026-27356](https://cve.now/CVE-2026-27356.md): WordPress MC4WP plugin \<= 4.14.1 - Broken Access Control vulnerability (CVSS 5.3, ibericode MC4WP)
- [CVE-2026-120845](https://cve.now/CVE-2026-120845.md): WordPress Smush Image Compression and Optimization plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPMU DEV Smush Image Compression and Optimization)
- [CVE-2026-123471](https://cve.now/CVE-2026-123471.md): WordPress myCred plugin \<= 4.0.2 - Content Injection vulnerability (CVSS 4.3, myCred)
- [CVE-2026-120851](https://cve.now/CVE-2026-120851.md): WordPress PublishPress Revisions plugin \<= 4.2.0 - Broken Access Control vulnerability (CVSS 4.3, PublishPress Revisions)
- [CVE-2026-119519](https://cve.now/CVE-2026-119519.md): WordPress Royal Elementor Addons plugin \<= 1.7.1068 - Broken Access Control vulnerability (CVSS 4.3, WProyal Royal Elementor Addons)
- [CVE-2026-122670](https://cve.now/CVE-2026-122670.md): WordPress Polylang plugin \<= 3.9 - Broken Access Control vulnerability (CVSS 5.4, WP SYNTEX Polylang)
- [CVE-2026-50240](https://cve.now/CVE-2026-50240.md): Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution… (CVSS 8.8, Builds for Red Hat OpenShift · Red Hat OpenShift Pipelin… +3)
- [CVE-2026-123791](https://cve.now/CVE-2026-123791.md): OpenBMB Internet of Agents Agent Registry milvus\_utils.py \_primary\_field\_query data query logic injection (CVSS 6.9, OpenBMB Internet of Agents)
- [CVE-2026-59104](https://cve.now/CVE-2026-59104.md): UgCS server HCI authentication bypass with empty credentials (CVSS 9.3, SPH Engineering UgCS)
- [CVE-2026-103022](https://cve.now/CVE-2026-103022.md): Urwid: handle\_short\_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS) (CVSS 5.3, urwid)
- [CVE-2026-94619](https://cve.now/CVE-2026-94619.md): FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files (CVSS 5.9, filegator)
- [CVE-2026-94618](https://cve.now/CVE-2026-94618.md): FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive (CVSS 5.4, filegator)
- [CVE-2026-119800](https://cve.now/CVE-2026-119800.md): Ryot: Cross-tenant collection read via \`collectionContents\` (CVSS 4.3, IgnisDa ryot)
- [CVE-2026-77442](https://cve.now/CVE-2026-77442.md): Ryot: \`createOrUpdateUserIntegration\` trusts a client-supplied \`integrationId\` with no ownership check, letting any user hijack/overwrite… (CVSS 5.9, IgnisDa ryot)
- [CVE-2026-104267](https://cve.now/CVE-2026-104267.md): Botan: scrypt V-buffer heap overflow on 32-bit from constructor-accepted parameters (CVSS 4.1, randombit botan)
- [CVE-2026-48057](https://cve.now/CVE-2026-48057.md): Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches\_dn (CVSS 2.1, randombit botan)
- [CVE-2026-47738](https://cve.now/CVE-2026-47738.md): liboqs: Uninitialized function-pointer dereference in OQS\_KEM\_encaps\_derand for NTRU KEMs (CVSS 5.3, open-quantum-safe liboqs)
- [CVE-2026-44519](https://cve.now/CVE-2026-44519.md): liboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others) (CVSS 5.1, open-quantum-safe liboqs)
- [CVE-2026-104254](https://cve.now/CVE-2026-104254.md): liboqs: Heap out-of-bounds read in LMS/HSS signature verification via unvalidated signature length (hss\_verify\_inc.c:215) (CVSS 5.3, open-quantum-safe liboqs)
- [CVE-2026-69128](https://cve.now/CVE-2026-69128.md): Chartbrew: AI orchestrator run\_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier +… (CVSS 4.6, chartbrew)
- [CVE-2026-68935](https://cve.now/CVE-2026-68935.md): Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections (CVSS 9.1, chartbrew)
- [CVE-2026-123788](https://cve.now/CVE-2026-123788.md): chenyme grok2api STT Billing voice\_ws\_handler.go behavioral workflow (CVSS 5.3, chenyme grok2api)
- [CVE-2026-68933](https://cve.now/CVE-2026-68933.md): Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage (CVSS 7.5, chartbrew)
- [CVE-2026-86005](https://cve.now/CVE-2026-86005.md): Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew (CVSS 9.3, chartbrew)
- [CVE-2026-85736](https://cve.now/CVE-2026-85736.md): Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths (CVSS 8.1, chartbrew)
- [CVE-2026-85726](https://cve.now/CVE-2026-85726.md): Chartbrew: Blind NoSQL injection via date variable in embedded chart (CVSS 7.5, chartbrew)
- [CVE-2026-85712](https://cve.now/CVE-2026-85712.md): Chartbrew: Cross-tenant project takeover via body.team\_id in /project routes (CVSS 8.8, chartbrew)
- [CVE-2026-85708](https://cve.now/CVE-2026-85708.md): Chartbrew: Private chart data disclosure via forgeable CB\_SECRET share tokens (CVSS 7.5, chartbrew)
- [CVE-2026-85295](https://cve.now/CVE-2026-85295.md): Chartbrew: Full account takeover via JWTs accepted under default CB\_SECRET (CVSS 9.8, chartbrew)
- [CVE-2026-54349](https://cve.now/CVE-2026-54349.md): Chartbrew SQL injection in dashboard filter substitution (CVSS 9.8, chartbrew)
- [CVE-2026-54589](https://cve.now/CVE-2026-54589.md): Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl) (CVSS 7.0, chartbrew)
- [CVE-2026-71397](https://cve.now/CVE-2026-71397.md): Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc\_server (CVSS 8.2, elixir-grpc grpc\_server · grpc\_server)
- [CVE-2026-123787](https://cve.now/CVE-2026-123787.md): nexmoe VidBee Local HTTP Service local-api.ts information disclosure (CVSS 5.3, nexmoe VidBee)
- [CVE-2026-71863](https://cve.now/CVE-2026-71863.md): SecureDrop: Onion Service client auth credentials copied to Monitor Server (CVSS 2.6, freedomofpress securedrop)
- [CVE-2026-102610](https://cve.now/CVE-2026-102610.md): fast-agent: \`fast-agent serve\` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote… (CVSS 6.4, evalstate fast-agent)
- [CVE-2026-124078](https://cve.now/CVE-2026-124078.md): plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser (CVSS 8.7, TooTallNate plist.js)
- [CVE-2026-102657](https://cve.now/CVE-2026-102657.md): esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal (CVSS 7.5, esm-dev esm.sh)
- [CVE-2026-102344](https://cve.now/CVE-2026-102344.md): Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local… (CVSS 8.1, kunchenguid lavish-axi)
- [CVE-2026-102530](https://cve.now/CVE-2026-102530.md): JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL (CVSS 9.4, jupyterlab-desktop)
- [CVE-2025-55002](https://cve.now/CVE-2025-55002.md): JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses (CVSS 5.5, jupyterlab-desktop)
- [CVE-2026-86044](https://cve.now/CVE-2026-86044.md): JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution (CVSS 9.6, jupyterlab-desktop)
- [CVE-2025-54991](https://cve.now/CVE-2025-54991.md): JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS) (CVSS 5.5, jupyterlab-desktop)
- [CVE-2026-85737](https://cve.now/CVE-2026-85737.md): Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin (CVSS 6.5, Velocidex velociraptor)
- [CVE-2026-63439](https://cve.now/CVE-2026-63439.md): 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification (CVSS 9.8, Bubka 2FAuth)
- [CVE-2026-63438](https://cve.now/CVE-2026-63438.md): 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value (CVSS 9.8, Bubka 2FAuth)
- [CVE-2026-63440](https://cve.now/CVE-2026-63440.md): 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU) (CVSS 5.9, Bubka 2FAuth)
- [CVE-2026-63441](https://cve.now/CVE-2026-63441.md): 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets (CVSS 4.9, Bubka 2FAuth)
- [CVE-2026-63437](https://cve.now/CVE-2026-63437.md): 2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration (CVSS 6.5, Bubka 2FAuth)
- [CVE-2026-59171](https://cve.now/CVE-2026-59171.md): JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS (CVSS 5.9, stleary JSON-java)
- [CVE-2026-65960](https://cve.now/CVE-2026-65960.md): Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods (CVSS 8.8, cilium tetragon)
- [CVE-2026-58490](https://cve.now/CVE-2026-58490.md): Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults (CVSS 9.8, TracecatHQ tracecat)
- [CVE-2026-63663](https://cve.now/CVE-2026-63663.md): CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access (CVSS 6.5, cloudbeaver)
- [CVE-2026-63664](https://cve.now/CVE-2026-63664.md): CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass (CVSS 6.5, cloudbeaver)
- [CVE-2026-55449](https://cve.now/CVE-2026-55449.md): CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox (CVSS 5.3, cloudbeaver)
- [CVE-2026-73860](https://cve.now/CVE-2026-73860.md): CRIU: Parasite hijack triggered by snapshot of malicious software (CVSS 5.4, checkpoint-restore criu)
- [CVE-2026-123974](https://cve.now/CVE-2026-123974.md): pytorch/serve: Local privilege escalation through insecure temporary path (CVSS 7.8, PyTorch TorchServe)
- [GHSA-47W9-6R3F-938G](https://cve.now/GHSA-47W9-6R3F-938G.md): LXD has restricted project bypass leading to arbitrary command execution (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-7MR3-28H5-M5VX](https://cve.now/GHSA-7MR3-28H5-M5VX.md): LXD has project restriction bypass for custom volume copy across projects (high (no CVSS), github.com/canonical/lxd)
- [GHSA-QX75-2P3R-PWM5](https://cve.now/GHSA-QX75-2P3R-PWM5.md): LXD has project restriction bypass in instance copy across projects (high (no CVSS), github.com/canonical/lxd)
- [CVE-2026-55649](https://cve.now/CVE-2026-55649.md): GeoNode has Stored XSS in Documents metadata abstract field (CVSS 6.3, geonode)
- [CVE-2026-46429](https://cve.now/CVE-2026-46429.md): GeoNode: Unrestricted File Upload (CVSS 5.5, geonode)
- [CVE-2026-33050](https://cve.now/CVE-2026-33050.md): GeoNode: OS command injection via uploaded file layer name (CVSS 8.8, geonode)
- [GHSA-PJFF-C2WC-F6JM](https://cve.now/GHSA-PJFF-C2WC-F6JM.md): LXD has arbitrary file write on client due to trusted image hash (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-FMC8-P6Q7-75CC](https://cve.now/GHSA-FMC8-P6Q7-75CC.md): LXD has argument injection in backup compression algorithm leading to AFW and ACE (critical (no CVSS), github.com/canonical/lxd)
- [GHSA-VGHH-5RFX-XHQ8](https://cve.now/GHSA-VGHH-5RFX-XHQ8.md): LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image (critical (no CVSS), github.com/canonical/lxd)
- [CVE-2026-109683](https://cve.now/CVE-2026-109683.md): UPnP Newline Injection Vulnerability in TP-Link Archer BE805 (CVSS 5.3, TP-Link Systems Archer BE805)
- [CVE-2026-124040](https://cve.now/CVE-2026-124040.md): CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State (CVSS 9.2, civetweb)
- [CVE-2026-124039](https://cve.now/CVE-2026-124039.md): Gitleaks through 8.30.1 World-Readable Report Files via --report-path (CVSS 4.8, gitleaks)
- [CVE-2026-124031](https://cve.now/CVE-2026-124031.md): GPAC through 26.07.0 Type Confusion via drawable\_get\_aspect\_2d\_mpeg4 (CVSS 6.8, gpac)
- [CVE-2026-124030](https://cve.now/CVE-2026-124030.md): GPAC through 26.07.0 Type Confusion via gf\_sg\_command\_apply XMT Field-Replace (CVSS 6.8, gpac)
- [CVE-2026-124029](https://cve.now/CVE-2026-124029.md): Kopia through 0.23.1 Path Traversal in Snapshot Restore via Directory Entry Names (CVSS 6.9, kopia)
- [CVE-2026-124028](https://cve.now/CVE-2026-124028.md): mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers (CVSS 2.3, EricLBuehler mistral.rs)
- [CVE-2026-124027](https://cve.now/CVE-2026-124027.md): ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage (CVSS 8.7, zhimaAi chatwiki)
- [CVE-2026-124026](https://cve.now/CVE-2026-124026.md): Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy (CVSS 5.3, karlomikus bar-assistant)
- [CVE-2026-124025](https://cve.now/CVE-2026-124025.md): Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print (CVSS 5.3, faveosuite faveo-helpdesk)
- [CVE-2026-19703](https://cve.now/CVE-2026-19703.md): A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially… (CVSS 5.1, SonicWall SonicOS)
- [CVE-2026-77709](https://cve.now/CVE-2026-77709.md): A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in… (CVSS 5.9, SonicWall SonicOS)
- [CVE-2026-77708](https://cve.now/CVE-2026-77708.md): A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in… (CVSS 5.9, SonicWall SonicOS)
- [CVE-2026-19868](https://cve.now/CVE-2026-19868.md): An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate… (CVSS 7.5, KEV, SonicWall SonicOS)
- [CVE-2026-123998](https://cve.now/CVE-2026-123998.md): Hisense VIDAA Smart TV MQTT Broker Authentication Bypass (CVSS 7.2, Hisense VIDAA)
- [CVE-2026-123997](https://cve.now/CVE-2026-123997.md): Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI (CVSS 7.1, Hisense VIDAA)
- [CVE-2026-123996](https://cve.now/CVE-2026-123996.md): Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication (CVSS 4.8, Hisense VIDAA)
- [CVE-2026-123995](https://cve.now/CVE-2026-123995.md): Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI (CVSS 4.8, Hisense VIDAA)
- [CVE-2026-123994](https://cve.now/CVE-2026-123994.md): Hisense VIDAA Smart TV DIAL Service Unauthenticated Access (CVSS 5.3, Hisense VIDAA)
- [CVE-2026-82308](https://cve.now/CVE-2026-82308.md): A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially… (CVSS 7.5, SonicWall SonicOS)
- [GHSA-JPF8-86F3-WP38](https://cve.now/GHSA-JPF8-86F3-WP38.md): LXD has arbitrary file read+write on host via templates/ symlink in malicious image (critical (no CVSS), github.com/canonical/lxd)
- [CVE-2026-123993](https://cve.now/CVE-2026-123993.md): Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access (CVSS 8.7, Hisense VIDAA)
- [CVE-2026-107154](https://cve.now/CVE-2026-107154.md): A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially… (CVSS 8.8, SonicWall SonicOS)
- [CVE-2026-107155](https://cve.now/CVE-2026-107155.md): A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could… (CVSS 8.8, SonicWall SonicOS)
- [GHSA-9J25-MM2H-2F76](https://cve.now/GHSA-9J25-MM2H-2F76.md): LXD has arbitrary file write on host via \`exec-output\` symlink in crafted image (critical (no CVSS), github.com/canonical/lxd)
- [CVE-2026-119924](https://cve.now/CVE-2026-119924.md): Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser (CVSS 8.1, AWS babelfish-for-postgresql · Amazon Aurora PostgreSQL wit…)
- [CVE-2026-123357](https://cve.now/CVE-2026-123357.md): GROBID is vulnerable to OS command injection through crafted PDF filenames (CVSS 0.0, grobidOrg grobid)
- [CVE-2026-122113](https://cve.now/CVE-2026-122113.md): CVE-2026-122113 (no CVSS, Realtek RtUsbA64.sys)
- [CVE-2026-90975](https://cve.now/CVE-2026-90975.md): CVE-2026-90975 (no CVSS, Realtek RtUsbA64.sys)
- [CVE-2026-119923](https://cve.now/CVE-2026-119923.md): Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser (CVSS 9.8, AWS babelfish-for-postgresql · Amazon Aurora PostgreSQL wit…)
- [CVE-2026-123356](https://cve.now/CVE-2026-123356.md): GROBID: Unauthenticated \`/api/modelTraining\` Endpoint Allows Unbounded Thread Pool Creation (DoS) (CVSS 7.5, grobidOrg grobid)
- [CVE-2026-108262](https://cve.now/CVE-2026-108262.md): DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 (CVSS 6.5, ddev)
- [CVE-2026-84473](https://cve.now/CVE-2026-84473.md): CVE-2026-84473 (no CVSS, Kiteworks ownCloud)
- [CVE-2026-100082](https://cve.now/CVE-2026-100082.md): xen-blkback: Avoid UAF when reading I/O statistics (no CVSS, Linux)
- [CVE-2026-100081](https://cve.now/CVE-2026-100081.md): xen-netback: defer xenvif\_mcast\_addr\_list\_free() (no CVSS, Linux)
- [CVE-2026-100080](https://cve.now/CVE-2026-100080.md): xen-netback: Fix UAF when reading statistics data (no CVSS, Linux)
- [CVE-2020-9709](https://cve.now/CVE-2020-9709.md): Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability. (no CVSS, Adobe Photoshop)
- [CVE-2019-16447](https://cve.now/CVE-2019-16447.md): Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. (CVSS 7.8, Adobe Illustrator CC)
- [CVE-2026-71495](https://cve.now/CVE-2026-71495.md): Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access (CVSS 10.0, open-wanderer wanderer)
- [CVE-2026-62346](https://cve.now/CVE-2026-62346.md): Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML (CVSS 7.6, open-wanderer wanderer)
- [CVE-2026-62345](https://cve.now/CVE-2026-62345.md): Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML) (CVSS 7.6, open-wanderer wanderer)
- [CVE-2026-123976](https://cve.now/CVE-2026-123976.md): EDFbrowser before 2.16 Out-of-Bounds Write via check\_edf\_file() Annotation Signals (CVSS 6.8, Teunis van Beelen EDFbrowser)
- [CVE-2026-62344](https://cve.now/CVE-2026-62344.md): Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints (CVSS 7.5, open-wanderer wanderer)
- [CVE-2026-75598](https://cve.now/CVE-2026-75598.md): Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization (CVSS 6.3, GradleUp shadow)
- [CVE-2026-89017](https://cve.now/CVE-2026-89017.md): Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass (CVSS 8.7, Skyline Communications DataMiner)
- [CVE-2026-123973](https://cve.now/CVE-2026-123973.md): SharePoint Products CopyMove before 2026-11-06 allows traversal. (CVSS 5.0, SharePoint Products CopyMove for SharePoint)
- [CVE-2026-119758](https://cve.now/CVE-2026-119758.md): ERPNext OCR 1.1.1 Path Traversal and SSRF via read\_document (CVSS 7.1, Monogramm erpnext\_ocr)
- [CVE-2026-102650](https://cve.now/CVE-2026-102650.md): Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API (CVSS 7.5, nuxt content)
- [CVE-2026-102356](https://cve.now/CVE-2026-102356.md): Kroki Mermaid companion SSRF via flowchart image URLs (CVSS 5.0, yuzutech kroki)
- [CVE-2026-123876](https://cve.now/CVE-2026-123876.md): Podman: containers-common: containers-common: default seccomp af\_vsock/netlink\_audit deny rules bypassable via 32-bit truncation (CVSS 4.4, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-102359](https://cve.now/CVE-2026-102359.md): Kroki: TikZ Secure Mode Local File Read via LaTeX File I/O Primitives (CVSS 7.5, yuzutech kroki)
- [CVE-2026-118670](https://cve.now/CVE-2026-118670.md): OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document (CVSS 8.8, OHIF Viewers)
- [CVE-2026-123824](https://cve.now/CVE-2026-123824.md): Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true (CVSS 2.3, sensiolabs symfony/config)
- [CVE-2026-85742](https://cve.now/CVE-2026-85742.md): FreeScout: Conditional stored admin XSS via failed-job details (CVSS 7.5, freescout-help-desk freescout)
- [CVE-2026-123748](https://cve.now/CVE-2026-123748.md): chenyme grok2api WebSocket Proxy voice\_ws\_handler.go proxyVoiceWebSocket resource consumption (CVSS 5.3, chenyme grok2api)
- [CVE-2026-103985](https://cve.now/CVE-2026-103985.md): FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save (CVSS 7.1, freescout-help-desk freescout)
- [CVE-2026-123962](https://cve.now/CVE-2026-123962.md): In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized\_keys… (CVSS 8.4, Debian FreedomBox)
- [CVE-2026-122193](https://cve.now/CVE-2026-122193.md): OS command injection in the example SSM documents in Trusted Remote Execution (REX) (CVSS 9.9, AWS trusted-remote-execution)
- [CVE-2026-103984](https://cve.now/CVE-2026-103984.md): FreeScout: Incomplete fix for CVE-2026-40570: load\_customer\_info exposes cross-visibility customer PII (CVSS 6.5, freescout-help-desk freescout)
- [CVE-2026-85743](https://cve.now/CVE-2026-85743.md): FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks (CVSS 8.2, freescout-help-desk freescout)
- [CVE-2026-85744](https://cve.now/CVE-2026-85744.md): FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass (CVSS 5.4, freescout-help-desk freescout)
- [CVE-2026-62850](https://cve.now/CVE-2026-62850.md): FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled… (CVSS 5.3, freescout-help-desk freescout)
- [CVE-2026-62852](https://cve.now/CVE-2026-62852.md): FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through… (CVSS 6.5, freescout-help-desk freescout)
- [CVE-2026-62855](https://cve.now/CVE-2026-62855.md): FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files (CVSS 4.4, freescout-help-desk freescout)
- [CVE-2026-106128](https://cve.now/CVE-2026-106128.md): Prototype Pollution in Progress Software Kendo UI for Vue (CVSS 4.1, Progress Software @progress/kendo-vue-common)
- [CVE-2026-62851](https://cve.now/CVE-2026-62851.md): FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (\`#\`) shortcut (missing mailbox… (CVSS 4.3, freescout-help-desk freescout)
- [CVE-2026-106127](https://cve.now/CVE-2026-106127.md): Prototype Pollution in Progress Software KendoReact (CVSS 4.1, Progress Software @progress/kendo-react-common)
- [CVE-2026-62856](https://cve.now/CVE-2026-62856.md): FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query (CVSS 7.7, freescout-help-desk freescout)
- [CVE-2026-106144](https://cve.now/CVE-2026-106144.md): Prototype Pollution in Progress Software Kendo UI for Angular (CVSS 4.1, Progress Software @progress/kendo-angular-common · Progress…)
- [CVE-2026-106143](https://cve.now/CVE-2026-106143.md): Cross-Site Scripting in Progress Software Kendo UI for Vue (CVSS 5.4, Progress Software @progress/kendo-vue-editor)
- [CVE-2026-106142](https://cve.now/CVE-2026-106142.md): Cross-Site Scripting in Progress Software KendoReact (CVSS 5.4, Progress Software @progress/kendo-react-editor)
- [CVE-2026-106141](https://cve.now/CVE-2026-106141.md): Cross-Site Scripting in Progress Software Kendo UI for Angular (CVSS 5.4, Progress Software @progress/kendo-angular-editor)
- [CVE-2026-106136](https://cve.now/CVE-2026-106136.md): Cross-Site Scripting in Progress Software KendoReact (CVSS 5.4, Progress Software @progress/kendo-react-conversational-ui)
- [CVE-2026-62854](https://cve.now/CVE-2026-62854.md): FreeScout: Stored XSS in mailbox signature via same-origin JS upload (CVSS 7.6, freescout-help-desk freescout)
- [CVE-2026-106134](https://cve.now/CVE-2026-106134.md): Cross-Site Scripting in Progress Software KendoReact (CVSS 5.4, Progress Software @progress/kendo-react-layout)
- [CVE-2026-106135](https://cve.now/CVE-2026-106135.md): Cross-Site Scripting in Progress Software Kendo UI for Angular (CVSS 5.4, Progress Software @progress/kendo-angular-conversational-ui)
- [CVE-2026-122053](https://cve.now/CVE-2026-122053.md): Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #\[Ignore\] on Nested Objects (CVSS 6.9, sensiolabs symfony/serializer)
- [CVE-2026-104656](https://cve.now/CVE-2026-104656.md): Cross-site Scripting in Progress Telerik Fiddler Everywhere (CVSS 7.3, Progress Software Progress® Telerik® Fiddler® Everywhere)
- [CVE-2026-104657](https://cve.now/CVE-2026-104657.md): Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill (CVSS 7.5, Progress Software Fiddler Download & Setup Skill)
- [CVE-2026-118515](https://cve.now/CVE-2026-118515.md): Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File (CVSS 8.4, sensiolabs symfony/serializer)
- [CVE-2026-123859](https://cve.now/CVE-2026-123859.md): SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) (CVSS 8.1, snowflake-connector-python)
- [CVE-2026-123858](https://cve.now/CVE-2026-123858.md): In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects (CVSS 4.4, JetBrains PhpStorm)
- [CVE-2026-123857](https://cve.now/CVE-2026-123857.md): In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection (CVSS 4.3, JetBrains PhpStorm)
- [CVE-2026-123856](https://cve.now/CVE-2026-123856.md): In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server (CVSS 6.5, JetBrains Toolbox App)
- [CVE-2026-123855](https://cve.now/CVE-2026-123855.md): In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs (CVSS 7.5, JetBrains Toolbox App)
- [CVE-2026-123854](https://cve.now/CVE-2026-123854.md): In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module (CVSS 5.5, JetBrains PyCharm)
- [CVE-2026-123853](https://cve.now/CVE-2026-123853.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the… (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123852](https://cve.now/CVE-2026-123852.md): In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates (CVSS 7.4, JetBrains Junie GitHub Action)
- [CVE-2026-123851](https://cve.now/CVE-2026-123851.md): In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters (CVSS 5.4, JetBrains Junie GitHub Action)
- [CVE-2026-123850](https://cve.now/CVE-2026-123850.md): In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives (CVSS 3.5, JetBrains YouTrack)
- [CVE-2026-123849](https://cve.now/CVE-2026-123849.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers (CVSS 7.0, JetBrains IntelliJ IDEA)
- [CVE-2026-123848](https://cve.now/CVE-2026-123848.md): In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates (CVSS 7.4, JetBrains IntelliJ IDEA)
- [CVE-2026-123847](https://cve.now/CVE-2026-123847.md): In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion (CVSS 5.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123846](https://cve.now/CVE-2026-123846.md): In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation (CVSS 4.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123845](https://cve.now/CVE-2026-123845.md): In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects (CVSS 3.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123844](https://cve.now/CVE-2026-123844.md): In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories (CVSS 5.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123843](https://cve.now/CVE-2026-123843.md): In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration (CVSS 3.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123842](https://cve.now/CVE-2026-123842.md): In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives (CVSS 7.1, JetBrains IntelliJ IDEA)
- [CVE-2026-123841](https://cve.now/CVE-2026-123841.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123840](https://cve.now/CVE-2026-123840.md): In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs (CVSS 4.7, JetBrains IntelliJ IDEA)
- [CVE-2026-123839](https://cve.now/CVE-2026-123839.md): In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port… (CVSS 4.7, JetBrains IntelliJ IDEA)
- [CVE-2026-123838](https://cve.now/CVE-2026-123838.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123837](https://cve.now/CVE-2026-123837.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123836](https://cve.now/CVE-2026-123836.md): In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup (CVSS 8.8, JetBrains Datalore)
- [CVE-2026-123835](https://cve.now/CVE-2026-123835.md): In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition (CVSS 5.9, JetBrains Datalore)
- [CVE-2026-123834](https://cve.now/CVE-2026-123834.md): In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account (CVSS 7.5, JetBrains Datalore)
- [CVE-2026-123833](https://cve.now/CVE-2026-123833.md): In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects (CVSS 3.6, JetBrains IntelliJ IDEA)
- [CVE-2026-123832](https://cve.now/CVE-2026-123832.md): In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database (CVSS 9.6, JetBrains CLion)
- [CVE-2026-123831](https://cve.now/CVE-2026-123831.md): In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings (CVSS 9.6, JetBrains CLion)
- [CVE-2026-49951](https://cve.now/CVE-2026-49951.md): RAGFlow \< 0.27.0 SSRF via set\_api\_key base\_url Parameter (CVSS 5.3, infiniflow ragflow)
- [CVE-2026-121623](https://cve.now/CVE-2026-121623.md): Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File (CVSS 8.2, sensiolabs symfony/serializer)
- [CVE-2026-80301](https://cve.now/CVE-2026-80301.md): Avast sandbox escape via unpreserved COM pathway through Task Scheduler (no CVSS, Gen Digital Avast Antivirus, Avast One, Avast Premium Se… +1)
- [CVE-2026-80302](https://cve.now/CVE-2026-80302.md): Avast sandbox escape via arbitrary file write in virtualized environment (no CVSS, Gen Digital Avast Antivirus, Avast One, Avast Premium Se… +1)
- [CVE-2026-111573](https://cve.now/CVE-2026-111573.md): Privilege escalation via unprotected Windows agent data folder (CVSS 6.3, Checkmk)
- [CVE-2026-80303](https://cve.now/CVE-2026-80303.md): Avast WFP stream parser integer underflow causes system crash (no CVSS, Gen Digital Avast Antivirus, Avast One, Avast Premium Se… +1)
- [CVE-2026-12067](https://cve.now/CVE-2026-12067.md): AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlers (no CVSS, Gen Digital Avast Antivirus, Avast One, Avast Premium Se… +1)
- [CVE-2026-58141](https://cve.now/CVE-2026-58141.md): Dify \< 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints (CVSS 7.2, langgenius dify)
- [CVE-2026-66986](https://cve.now/CVE-2026-66986.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.3, HCL Software HCL AION)
- [CVE-2026-123677](https://cve.now/CVE-2026-123677.md): xxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorization (CVSS 5.3, xxyopen novel · 201206030 novel)
- [CVE-2026-90436](https://cve.now/CVE-2026-90436.md): Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName (critical (no CVSS), Apache Software Foundation axis:axis · Apache Software F… +1)
- [CVE-2026-66987](https://cve.now/CVE-2026-66987.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 5.3, HCL Software HCL AION)
- [CVE-2026-66982](https://cve.now/CVE-2026-66982.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.3, HCL Software HCL AION)
- [CVE-2026-66984](https://cve.now/CVE-2026-66984.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.1, HCL Software HCL AION)
- [CVE-2026-123676](https://cve.now/CVE-2026-123676.md): xxyopen/201206030 novel Book Content Service BookServiceImpl.java BookServiceImpl.getBookContentAbout improper authorization (CVSS 6.9, xxyopen novel · 201206030 novel)
- [CVE-2026-66981](https://cve.now/CVE-2026-66981.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 6.5, HCL Software HCL AION)
- [CVE-2026-21834](https://cve.now/CVE-2026-21834.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.1, HCL Software HCL AION)
- [CVE-2026-123792](https://cve.now/CVE-2026-123792.md): Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process (CVSS 8.7, sensiolabs symfony/yaml)
- [CVE-2026-123623](https://cve.now/CVE-2026-123623.md): Grida through 0.0.24 Missing Authorization in Forms File-Preview API (CVSS 8.2, gridaco grida)
- [CVE-2026-123675](https://cve.now/CVE-2026-123675.md): OpenBMB Internet of Agents Code Executor Tool code\_executor.py execute\_code code injection (CVSS 6.9, OpenBMB Internet of Agents)
- [CVE-2026-121880](https://cve.now/CVE-2026-121880.md): RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership (CVSS 4.7, Posit Software, PBC Posit Workbench · Posit Software, PBC R…)
- [CVE-2026-121881](https://cve.now/CVE-2026-121881.md): Posit Workbench code-server session-state RPC (get\_last\_seen) SQL injection (CVSS 5.7, Posit Software, PBC Posit Workbench)
- [CVE-2026-123786](https://cve.now/CVE-2026-123786.md): Agenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token (CVSS 8.4, Agenta-AI agenta)
- [CVE-2026-123785](https://cve.now/CVE-2026-123785.md): Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry (CVSS 6.8, fluxbox)
- [CVE-2026-123784](https://cve.now/CVE-2026-123784.md): Fluxbox through 1.3.7 OS Command Injection via Style Background Values (CVSS 8.5, fluxbox)
- [CVE-2026-123783](https://cve.now/CVE-2026-123783.md): Skyvern through 1.0.56 Script Sandbox Bypass via types.CodeType Bytecode (CVSS 8.7, Skyvern-AI skyvern)
- [CVE-2026-123782](https://cve.now/CVE-2026-123782.md): ChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired (CVSS 5.3, zhimaAi chatwiki)
- [CVE-2026-123624](https://cve.now/CVE-2026-123624.md): ChatWiki before 2.10.0 Cross-Tenant Fast Command Modification via saveFastCommand (CVSS 5.3, zhimaAi chatwiki)
- [CVE-2026-123622](https://cve.now/CVE-2026-123622.md): Usermin through 2.570 XSS via mailbox detach.cgi type Parameter (CVSS 5.1, webmin usermin)
- [CVE-2026-123621](https://cve.now/CVE-2026-123621.md): Usermin through 2.570 Path Traversal File Write via detachall.cgi (CVSS 8.6, webmin usermin)
- [CVE-2026-123620](https://cve.now/CVE-2026-123620.md): Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion (CVSS 7.7, webmin usermin)
- [CVE-2026-123619](https://cve.now/CVE-2026-123619.md): Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths (CVSS 5.9, lektor)
- [CVE-2026-123618](https://cve.now/CVE-2026-123618.md): ABP Framework before 10.7.1 Authentication Bypass via External Login Provider (CVSS 7.6, abpframework abp)
- [CVE-2026-123617](https://cve.now/CVE-2026-123617.md): Openwhyd before 1.65.1 NoSQL Injection via POST /api/user (CVSS 6.9, openwhyd)
- [CVE-2026-123492](https://cve.now/CVE-2026-123492.md): SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-123491](https://cve.now/CVE-2026-123491.md): Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select (CVSS 8.8, craftcms cms)
- [CVE-2026-123490](https://cve.now/CVE-2026-123490.md): Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass (CVSS 8.7, craftcms cms)
- [CVE-2026-123489](https://cve.now/CVE-2026-123489.md): Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria (CVSS 7.1, craftcms cms)
- [CVE-2026-123488](https://cve.now/CVE-2026-123488.md): Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint (CVSS 9.3, craftcms cms)
- [CVE-2026-123487](https://cve.now/CVE-2026-123487.md): Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex (CVSS 8.7, parse-community parse-server)
- [CVE-2026-123486](https://cve.now/CVE-2026-123486.md): WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php (CVSS 6.0, WWBN AVideo)
- [CVE-2026-123485](https://cve.now/CVE-2026-123485.md): Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources (CVSS 7.1, sgoudelis ground-station)
- [CVE-2026-112341](https://cve.now/CVE-2026-112341.md): Wazuh before 4.14.9 SQL Injection via WazuhDBBackend \_substitute\_params (CVSS 7.1, wazuh)
- [CVE-2026-112340](https://cve.now/CVE-2026-112340.md): Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request (CVSS 8.8, wazuh-dashboard-plugins)
- [CVE-2026-112339](https://cve.now/CVE-2026-112339.md): Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module (CVSS 8.2, wazuh)
- [CVE-2026-112338](https://cve.now/CVE-2026-112338.md): Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination (CVSS 8.2, wazuh)
- [CVE-2026-112337](https://cve.now/CVE-2026-112337.md): Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination (CVSS 6.3, wazuh)
- [CVE-2026-112336](https://cve.now/CVE-2026-112336.md): Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder (CVSS 7.1, wazuh)
- [CVE-2026-112335](https://cve.now/CVE-2026-112335.md): Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read\_snortfull (CVSS 6.8, wazuh)
- [CVE-2026-112334](https://cve.now/CVE-2026-112334.md): Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf (CVSS 6.9, wazuh)
- [CVE-2026-53980](https://cve.now/CVE-2026-53980.md): Charmbracelet Wish 2.0.5 Path Traversal via git Middleware (CVSS 8.6, charmbracelet wish)
- [CVE-2026-119170](https://cve.now/CVE-2026-119170.md): Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 (CVSS 8.2, Python Software Foundation CPython)
- [CVE-2026-123665](https://cve.now/CVE-2026-123665.md): kubescape Output printresults.go GetWriter permission (CVSS 2.4, kubescape)
- [CVE-2026-123339](https://cve.now/CVE-2026-123339.md): Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request (CVSS 2.3, sensiolabs symfony/http-kernel)
- [CVE-2026-87045](https://cve.now/CVE-2026-87045.md): NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame (CVSS 7.5, zephyrproject zephyr)
- [CVE-2026-123664](https://cve.now/CVE-2026-123664.md): nasa-gcn gcn.nasa.gov Email Notification email improper authorization (CVSS 5.3, nasa-gcn gcn.nasa.gov)
- [CVE-2026-106019](https://cve.now/CVE-2026-106019.md): Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating… (CVSS 8.8, Johnson Controls C-CURE 9000, Victor)
- [CVE-2026-113618](https://cve.now/CVE-2026-113618.md): Improper Server Certificate Validation in ZSIRep Client Library (CVSS 5.3, KAMSOFT ZSIRep Client Library)
- [CVE-2026-64894](https://cve.now/CVE-2026-64894.md): Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows… (CVSS 7.3, Johnson Controls EasyIO Neo IOManager and Tools Installer)
- [CVE-2026-118514](https://cve.now/CVE-2026-118514.md): Symfony: HEAD Requests Bypass the methods Option of security.access\_control Rules and Firewalls (CVSS 6.3, symfony/http-foundation)
- [CVE-2026-59105](https://cve.now/CVE-2026-59105.md): Universal sysadmin credential vulnerability in Jumis (CVSS 9.8, Jumis Pro SIA Jumis)
- [CVE-2026-106022](https://cve.now/CVE-2026-106022.md): Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows… (CVSS 8.6, Johnson Controls EasyIO Neo IOManager and Tools Installer)
- [CVE-2026-106020](https://cve.now/CVE-2026-106020.md): Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows… (CVSS 8.6, Johnson Controls EasyIO Neo IO Manager and Tools Installer)
- [CVE-2026-21850](https://cve.now/CVE-2026-21850.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 6.5, HCL Software HCL AION)
- [CVE-2026-5345](https://cve.now/CVE-2026-5345.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL AION)
- [CVE-2026-21849](https://cve.now/CVE-2026-21849.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL AION)
- [CVE-2026-35107](https://cve.now/CVE-2026-35107.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.7, HCL Software HCL AION)
- [CVE-2026-35106](https://cve.now/CVE-2026-35106.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.7, HCL Software HCL AION)
- [CVE-2026-35105](https://cve.now/CVE-2026-35105.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.7, HCL Software HCL AION)
- [CVE-2026-35104](https://cve.now/CVE-2026-35104.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.7, HCL Software HCL AION)
- [CVE-2026-35103](https://cve.now/CVE-2026-35103.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.7, HCL Software HCL AION)
- [CVE-2026-35102](https://cve.now/CVE-2026-35102.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.7, HCL Software HCL AION)
- [CVE-2026-35109](https://cve.now/CVE-2026-35109.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL AION)
- [CVE-2026-123653](https://cve.now/CVE-2026-123653.md): esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input (CVSS 5.3, esengine DeepSeek-Reasonix)
- [CVE-2026-35110](https://cve.now/CVE-2026-35110.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 5.4, HCL Software HCL AION)
- [CVE-2026-35112](https://cve.now/CVE-2026-35112.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.2, HCL Software HCL AION)
- [CVE-2026-35113](https://cve.now/CVE-2026-35113.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.8, HCL Software HCL AION)
- [CVE-2026-35111](https://cve.now/CVE-2026-35111.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 4.8, HCL Software HCL AION)
- [CVE-2026-35114](https://cve.now/CVE-2026-35114.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software HCL AION)
- [CVE-2026-35115](https://cve.now/CVE-2026-35115.md): HCL AION is affected by multiple security vulnerabilities. (CVSS 3.7, HCL Software AION)
- [CVE-2026-92080](https://cve.now/CVE-2026-92080.md): Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair (CVSS 4.3, TÜBİTAK BİLGEM Software Technologies Research Institute par…)
- [CVE-2026-115431](https://cve.now/CVE-2026-115431.md): WordPress Upsell Order Bump Offer for WooCommerce plugin \<= 3.1.6 - Broken Access Control vulnerability (CVSS 7.1, WP Swings Upsell Order Bump Offer for WooCommerce)
- [CVE-2026-115952](https://cve.now/CVE-2026-115952.md): WordPress Forminator plugin \<= 1.58.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPMU DEV Forminator)
- [CVE-2026-105422](https://cve.now/CVE-2026-105422.md): Path Traversal in TÜBİTAK BİLGEM's pardus-boot-repair (CVSS 6.6, TÜBİTAK BİLGEM Software Technologies Research Institute par…)
- [CVE-2026-123746](https://cve.now/CVE-2026-123746.md): Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers (CVSS 2.3, sensiolabs symfony/security-http)
- [CVE-2026-109883](https://cve.now/CVE-2026-109883.md): WordPress Elementor Website Builder plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Elementor Website Builder)
- [CVE-2026-109884](https://cve.now/CVE-2026-109884.md): WordPress Elementor Website Builder plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Elementor Website Builder)
- [RUSTSEC-2026-0443](https://cve.now/RUSTSEC-2026-0443.md): Hidden file disclosure through Windows short names (no CVSS, actix-files)
- [RUSTSEC-2026-0445](https://cve.now/RUSTSEC-2026-0445.md): Degraded secret zeroization capabilities (no CVSS, vodozemac)
- [RUSTSEC-2026-0446](https://cve.now/RUSTSEC-2026-0446.md): Request smuggling through malformed chunked request trailers (no CVSS, actix-http)
- [RUSTSEC-2026-0447](https://cve.now/RUSTSEC-2026-0447.md): Compressed request bodies can exhaust memory before extractor limits apply (no CVSS, actix-web)
- [RUSTSEC-2026-0448](https://cve.now/RUSTSEC-2026-0448.md): Unbounded decompression can exhaust memory and CPU resources (no CVSS, actix-http)
- [RUSTSEC-2026-0451](https://cve.now/RUSTSEC-2026-0451.md): Degraded secret zeroization capabilities (no CVSS, vodozemac)
- [RUSTSEC-2026-0455](https://cve.now/RUSTSEC-2026-0455.md): Large-window Brotli bodies bypass decompression memory limits (no CVSS, actix-http)
- [CVE-2026-85111](https://cve.now/CVE-2026-85111.md): Apache James: Denial of service upon MIME parsing (CVSS 8.7, Apache Software Foundation Apache James · Apache Software F…)
- [CVE-2026-85108](https://cve.now/CVE-2026-85108.md): Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling (no CVSS, Apache Software Foundation org.apache.james:apache-mime4j-c…)
- [CVE-2026-123655](https://cve.now/CVE-2026-123655.md): Moodle: missing access checks on h5p content files (CVSS 7.5, moodle)
- [CVE-2026-76168](https://cve.now/CVE-2026-76168.md): Apache James: ManageSieve file implementation cross-user path traversal (no CVSS, Apache Software Foundation Apache James)
- [CVE-2026-74756](https://cve.now/CVE-2026-74756.md): Apache James: WebAdmin exposed without authentication on official Docker default (low (no CVSS), Apache Software Foundation Apache James)
- [CVE-2026-76171](https://cve.now/CVE-2026-76171.md): Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client (low (no CVSS), Apache Software Foundation Apache James)
- [CVE-2026-49939](https://cve.now/CVE-2026-49939.md): Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol (no CVSS, Apache Software Foundation Apache James)
- [CVE-2025-66621](https://cve.now/CVE-2025-66621.md): Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred (no CVSS, Apache Software Foundation Apache James)
- [CVE-2026-103908](https://cve.now/CVE-2026-103908.md): AMP for WP \<= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info (CVSS 5.4, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2026-120035](https://cve.now/CVE-2026-120035.md): RSS Aggregator by Feedzy \<= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title (CVSS 5.4, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2026-107658](https://cve.now/CVE-2026-107658.md): BuddyForms \<= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf\_post\_type' Parameter via Post-Type Confusion (CVSS 5.4, themekraft BuddyForms)
- [CVE-2026-119178](https://cve.now/CVE-2026-119178.md): Smart Cookie Kit \<= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration (CVSS 5.4, shark986 Smart Cookie Kit)
- [CVE-2026-92895](https://cve.now/CVE-2026-92895.md): Live2DWebCanvas \<= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter (CVSS 8.1, jiangweifang Live2DWebCanvas)
- [CVE-2026-116624](https://cve.now/CVE-2026-116624.md): Advanced Members for ACF \<= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form (CVSS 8.8, danbilabs Advanced Members for ACF)
- [CVE-2026-116545](https://cve.now/CVE-2026-116545.md): All-in-One Video Gallery \<= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field (CVSS 6.4, plugins360 All-in-One Video Gallery – Video Player & Galler…)
- [CVE-2026-119211](https://cve.now/CVE-2026-119211.md): AAA Autoload Optimizer \<= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option\_page' Parameter via 'all' Hook (CVSS 4.9, progressplanner AAA Autoload Optimizer)
- [CVE-2026-116551](https://cve.now/CVE-2026-116551.md): WP Customer Area \<= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display\_name' Parameter (CVSS 6.4, aguilatechnologies WP Customer Area)
- [CVE-2026-104010](https://cve.now/CVE-2026-104010.md): WPSyncSheets For Contact Form 7 \<= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission… (CVSS 7.5, creativewerkdesigns WPSyncSheets For Contact Form 7 – CF7 G…)
- [CVE-2026-107622](https://cve.now/CVE-2026-107622.md): BuddyForms \<= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf\_post\_type' Parameter (CVSS 9.8, themekraft BuddyForms)
- [CVE-2026-114630](https://cve.now/CVE-2026-114630.md): ELEX WordPress HelpDesk & Customer Ticketing System \<= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket\_attachment\_path'… (CVSS 9.1, elextensions ELEX WordPress HelpDesk & Customer Ticketing S…)
- [CVE-2026-89101](https://cve.now/CVE-2026-89101.md): Everest Forms \<= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP… (CVSS 6.5, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2026-103479](https://cve.now/CVE-2026-103479.md): Pubjet | پاب‌جت \<= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action (CVSS 7.6, Pubjet | پاب‌جت)
- [CVE-2026-84161](https://cve.now/CVE-2026-84161.md): Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics (CVSS 4.9, Ericsson CodeChecker)
- [CVE-2026-84164](https://cve.now/CVE-2026-84164.md): Stored XSS in the static HTML report export, because json.dumps does not escape the markup character (CVSS 0.0, Ericsson CodeChecker)
- [CVE-2026-115701](https://cve.now/CVE-2026-115701.md): Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion (CVSS 8.2, ninenines cowboy · cowboy)
- [CVE-2026-113431](https://cve.now/CVE-2026-113431.md): Unbounded decoded HTTP/2 header-list size in cowlib cow\_http2\_machine enables HPACK amplification memory exhaustion (CVSS 8.7, ninenines cowlib · cowlib)
- [CVE-2026-123337](https://cve.now/CVE-2026-123337.md): In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility (CVSS 3.1, JetBrains YouTrack)
- [CVE-2026-123336](https://cve.now/CVE-2026-123336.md): In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion (CVSS 3.1, JetBrains YouTrack)
- [CVE-2026-123335](https://cve.now/CVE-2026-123335.md): In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the… (CVSS 3.5, JetBrains YouTrack)
- [CVE-2026-123334](https://cve.now/CVE-2026-123334.md): In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project (CVSS 3.8, JetBrains YouTrack)
- [CVE-2026-123333](https://cve.now/CVE-2026-123333.md): In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints (CVSS 3.8, JetBrains YouTrack)
- [CVE-2026-123332](https://cve.now/CVE-2026-123332.md): In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations (CVSS 4.7, JetBrains YouTrack)
- [CVE-2026-123331](https://cve.now/CVE-2026-123331.md): In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles (CVSS 5.4, JetBrains YouTrack)
- [CVE-2026-123330](https://cve.now/CVE-2026-123330.md): In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings (CVSS 5.4, JetBrains YouTrack)
- [CVE-2026-123329](https://cve.now/CVE-2026-123329.md): In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions (CVSS 5.4, JetBrains YouTrack)
- [CVE-2026-123328](https://cve.now/CVE-2026-123328.md): In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab (CVSS 6.4, JetBrains YouTrack)
- [CVE-2026-123327](https://cve.now/CVE-2026-123327.md): In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions (CVSS 7.5, JetBrains YouTrack)
- [CVE-2026-123326](https://cve.now/CVE-2026-123326.md): In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension (CVSS 7.1, JetBrains YouTrack)
- [CVE-2026-123325](https://cve.now/CVE-2026-123325.md): In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin… (CVSS 7.1, JetBrains YouTrack)
- [CVE-2026-123324](https://cve.now/CVE-2026-123324.md): In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible (CVSS 7.7, JetBrains YouTrack)
- [CVE-2026-123323](https://cve.now/CVE-2026-123323.md): In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send… (CVSS 8.4, JetBrains YouTrack)
- [CVE-2026-123322](https://cve.now/CVE-2026-123322.md): In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader (CVSS 6.3, JetBrains WebStorm)
- [CVE-2026-123321](https://cve.now/CVE-2026-123321.md): In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects (CVSS 7.8, JetBrains WebStorm)
- [CVE-2026-123320](https://cve.now/CVE-2026-123320.md): In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server (CVSS 3.1, JetBrains Toolbox App)
- [CVE-2026-123319](https://cve.now/CVE-2026-123319.md): In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection (CVSS 3.7, JetBrains Ktor)
- [CVE-2026-123318](https://cve.now/CVE-2026-123318.md): In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine (CVSS 4.8, JetBrains Ktor)
- [CVE-2026-123317](https://cve.now/CVE-2026-123317.md): In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies (CVSS 8.1, JetBrains Ktor)
- [CVE-2026-123316](https://cve.now/CVE-2026-123316.md): In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs (CVSS 5.5, JetBrains Junie CLI)
- [CVE-2026-123315](https://cve.now/CVE-2026-123315.md): In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option (CVSS 7.0, JetBrains Junie CLI)
- [CVE-2026-123314](https://cve.now/CVE-2026-123314.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request (CVSS 3.1, JetBrains IntelliJ IDEA)
- [CVE-2026-123313](https://cve.now/CVE-2026-123313.md): In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings (CVSS 3.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123312](https://cve.now/CVE-2026-123312.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing (CVSS 3.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123311](https://cve.now/CVE-2026-123311.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible (CVSS 5.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123310](https://cve.now/CVE-2026-123310.md): In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects (CVSS 5.4, JetBrains IntelliJ IDEA)
- [CVE-2026-123309](https://cve.now/CVE-2026-123309.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview (CVSS 6.1, JetBrains IntelliJ IDEA)
- [CVE-2026-123308](https://cve.now/CVE-2026-123308.md): In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects (CVSS 6.3, JetBrains IntelliJ IDEA)
- [CVE-2026-123307](https://cve.now/CVE-2026-123307.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible (CVSS 6.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123306](https://cve.now/CVE-2026-123306.md): In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs (CVSS 7.4, JetBrains IntelliJ IDEA)
- [CVE-2026-123305](https://cve.now/CVE-2026-123305.md): In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host (CVSS 7.5, JetBrains IntelliJ IDEA)
- [CVE-2026-123304](https://cve.now/CVE-2026-123304.md): In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123302](https://cve.now/CVE-2026-123302.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script… (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123301](https://cve.now/CVE-2026-123301.md): In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible (CVSS 8.2, JetBrains IntelliJ IDEA)
- [CVE-2026-123300](https://cve.now/CVE-2026-123300.md): In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings (CVSS 2.7, JetBrains Hub)
- [CVE-2026-123299](https://cve.now/CVE-2026-123299.md): In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible (CVSS 3.1, JetBrains Hub)
- [CVE-2026-123298](https://cve.now/CVE-2026-123298.md): In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible (CVSS 5.0, JetBrains Hub)
- [CVE-2026-123297](https://cve.now/CVE-2026-123297.md): In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow (CVSS 6.8, JetBrains Hub)
- [CVE-2026-123296](https://cve.now/CVE-2026-123296.md): In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible (CVSS 7.5, JetBrains Hub)
- [CVE-2026-123295](https://cve.now/CVE-2026-123295.md): In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint (CVSS 8.1, JetBrains Hub)
- [CVE-2026-123294](https://cve.now/CVE-2026-123294.md): In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow (CVSS 9.6, JetBrains Hub)
- [CVE-2026-123293](https://cve.now/CVE-2026-123293.md): In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-123292](https://cve.now/CVE-2026-123292.md): In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid (CVSS 2.7, JetBrains Datalore)
- [CVE-2026-123291](https://cve.now/CVE-2026-123291.md): In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook (CVSS 4.3, JetBrains Datalore)
- [CVE-2026-123290](https://cve.now/CVE-2026-123290.md): In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content… (CVSS 5.3, JetBrains Datalore)
- [CVE-2026-123289](https://cve.now/CVE-2026-123289.md): In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files (CVSS 5.4, JetBrains Datalore)
- [CVE-2026-123288](https://cve.now/CVE-2026-123288.md): In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link (CVSS 5.4, JetBrains Datalore)
- [CVE-2026-123287](https://cve.now/CVE-2026-123287.md): In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports (CVSS 5.9, JetBrains Datalore)
- [CVE-2026-123286](https://cve.now/CVE-2026-123286.md): In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token (CVSS 5.9, JetBrains Datalore)
- [CVE-2026-123285](https://cve.now/CVE-2026-123285.md): In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection (CVSS 6.3, JetBrains Datalore)
- [CVE-2026-123284](https://cve.now/CVE-2026-123284.md): In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content (CVSS 6.5, JetBrains Datalore)
- [CVE-2026-123283](https://cve.now/CVE-2026-123283.md): In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account (CVSS 6.8, JetBrains Datalore)
- [CVE-2026-123282](https://cve.now/CVE-2026-123282.md): In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session (CVSS 7.4, JetBrains Datalore)
- [CVE-2026-123281](https://cve.now/CVE-2026-123281.md): In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker (CVSS 7.5, JetBrains Datalore)
- [CVE-2026-123280](https://cve.now/CVE-2026-123280.md): In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports (CVSS 8.1, JetBrains Datalore)
- [CVE-2026-123279](https://cve.now/CVE-2026-123279.md): In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators (CVSS 9.0, JetBrains Datalore)
- [CVE-2026-123278](https://cve.now/CVE-2026-123278.md): In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint (CVSS 6.7, JetBrains IntelliJ IDEA)
- [CVE-2026-123277](https://cve.now/CVE-2026-123277.md): In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux (CVSS 5.0, JetBrains CLion)
- [CVE-2026-123276](https://cve.now/CVE-2026-123276.md): In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile (CVSS 7.8, JetBrains CLion)
- [CVE-2026-84155](https://cve.now/CVE-2026-84155.md): Session Token Remains Valid After Logout in Multi-Worker Deployments (CVSS 5.3, Ericsson CodeChecker)
- [CVE-2026-66294](https://cve.now/CVE-2026-66294.md): XML injection in Saxy via unescaped CDATA section terminator (CVSS 2.1, qcam saxy · saxy)
- [CVE-2026-66295](https://cve.now/CVE-2026-66295.md): Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection (CVSS 2.1, qcam saxy · saxy)
- [CVE-2026-66293](https://cve.now/CVE-2026-66293.md): XML comment injection in Saxy encoder via unescaped double hyphen (CVSS 2.1, qcam saxy · saxy)
- [CVE-2026-116630](https://cve.now/CVE-2026-116630.md): undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation (CVSS 5.9, undici)
- [CVE-2026-120415](https://cve.now/CVE-2026-120415.md): undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping (CVSS 5.9, undici)
- [CVE-2026-120423](https://cve.now/CVE-2026-120423.md): undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata (CVSS 5.9, undici)
- [CVE-2026-33379](https://cve.now/CVE-2026-33379.md): Dashboard snapshot permission bypass (CVSS 8.5, Grafana OSS · Grafana Enterprise)
- [CVE-2026-116592](https://cve.now/CVE-2026-116592.md): undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops (CVSS 7.4, undici)
- [CVE-2026-120222](https://cve.now/CVE-2026-120222.md): undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay (CVSS 5.9, undici)
- [CVE-2026-120474](https://cve.now/CVE-2026-120474.md): undici vulnerable to cross-user cache disclosure via same-origin redirect (CVSS 6.5, undici)
- [CVE-2026-115831](https://cve.now/CVE-2026-115831.md): VOD Infomaniak \<= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX… (CVSS 4.3, infomaniak-dev VOD Infomaniak)
- [CVE-2026-97642](https://cve.now/CVE-2026-97642.md): Wp Parsidate \<= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute (CVSS 6.4, man4toman Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارس…)
- [CVE-2026-120659](https://cve.now/CVE-2026-120659.md): Redirection for Contact Form 7 \<= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File… (CVSS 5.3, themeisle Redirection for Contact Form)
- [CVE-2026-109977](https://cve.now/CVE-2026-109977.md): YaySMTP \<= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params\[searchKey\]' Parameter (CVSS 4.9, yaycommerce YaySMTP – WP Mail SMTP with Email Logs, Trackin…)
- [CVE-2026-109994](https://cve.now/CVE-2026-109994.md): Eventin \<= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter (CVSS 6.5, arraytics Eventin – Events Calendar, Tickets, Registration,…)
- [CVE-2026-110776](https://cve.now/CVE-2026-110776.md): MDTF \<= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter (CVSS 7.2, realmag777 MDTF – Meta Data and Taxonomies Filter)
- [CVE-2026-87964](https://cve.now/CVE-2026-87964.md): Product Feed Manager for WooCommerce \<= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2'… (CVSS 7.2, wahid0003 Product Feed Manager for WooCommerce – CTX Feed –…)
- [CVE-2026-120550](https://cve.now/CVE-2026-120550.md): WP User Manager \<= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display\_name' User Meta (CVSS 6.4, wpusermanager WP User Manager – Registration Form, Login Fo…)
- [CVE-2026-123087](https://cve.now/CVE-2026-123087.md): SQL injection in Atmira’s SIREC (CVSS 8.7, Atmira SIREC)
- [CVE-2026-103682](https://cve.now/CVE-2026-103682.md): Jolokia special agent exposes password in process list (CVSS 2.0, Checkmk)
- [CVE-2026-103674](https://cve.now/CVE-2026-103674.md): NetApp ONTAP special agent exposes password in process list (CVSS 2.0, Checkmk)
- [CVE-2026-123660](https://cve.now/CVE-2026-123660.md): Vulnerability-Lookup: memory amplification through webhook payload template format specifiers (CVSS 5.3, vulnerability-lookup)
- [CVE-2026-122222](https://cve.now/CVE-2026-122222.md): Permalink Manager Lite \<= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (CVSS 6.4, mbis Permalink Manager Lite)
- [CVE-2026-121794](https://cve.now/CVE-2026-121794.md): Travelly \<= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit\_form\_top Handler… (CVSS 6.5, magepeopleteam Travelly – Tour & Travel Booking Manager for…)
- [CVE-2026-118189](https://cve.now/CVE-2026-118189.md): Posts Table with Search & Sort \<= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date\_format' Shortcode Attribute (CVSS 6.4, barn2media Posts Table with Search & Sort)
- [CVE-2026-110291](https://cve.now/CVE-2026-110291.md): Graphina \<= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings (CVSS 7.2, iqonicdesign Graphina – Charts and Graphs For Elementor)
- [CVE-2026-120671](https://cve.now/CVE-2026-120671.md): UsersWP \<= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute (CVSS 6.4, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-19877](https://cve.now/CVE-2026-19877.md): Brute-forceable image-share link password in INFINITT ULite (CVSS 7.5, INFINITT Healthcare INFINITT ULite)
- [CVE-2026-19876](https://cve.now/CVE-2026-19876.md): Reflected XSS in INFINITT ULite login error page (pre-auth) (CVSS 6.1, INFINITT Healthcare INFINITT ULite)
- [CVE-2026-108018](https://cve.now/CVE-2026-108018.md): BigFix Mobile is affected by sensitive information disclosure (CVSS 6.3, HCLSoftware BigFix MCM & Mobile)
- [CVE-2026-119516](https://cve.now/CVE-2026-119516.md): WordPress Radius Booking — Booking Calendar for Appointments & Services plugin \<= 1.0.20 - PHP Object Injection vulnerability (CVSS 9.8, Mamunur Rashid Radius Booking — Booking Calendar for Appoin…)
- [CVE-2026-119472](https://cve.now/CVE-2026-119472.md): WordPress Redux Framework plugin \<= 4.5.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, David Anderson Redux Framework)
- [CVE-2026-120844](https://cve.now/CVE-2026-120844.md): WordPress OAuth Single Sign On – SSO (OAuth Client) plugin \<= 7.1.3 - Privilege Escalation vulnerability (CVSS 9.8, miniOrange OAuth Single Sign On – SSO)
- [CVE-2026-39744](https://cve.now/CVE-2026-39744.md): WordPress WCFM Membership plugin \<= 2.12.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WC Lovers WCFM Membership)
- [CVE-2026-119488](https://cve.now/CVE-2026-119488.md): WordPress Pie Register plugin \<= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shamim Rajani Pie Register)
- [CVE-2026-119499](https://cve.now/CVE-2026-119499.md): WordPress FloristPress plugin \<= 7.8.4 - Sensitive Data Exposure vulnerability (CVSS 7.5, BAKKBONE Australia FloristPress)
- [CVE-2026-65022](https://cve.now/CVE-2026-65022.md): BigFix Mobile is affected by a Cross-site scripting vulnerability (CVSS 6.3, HCLSoftware BigFix MCM & Mobile)
- [CVE-2026-121006](https://cve.now/CVE-2026-121006.md): HTTP::Body versions before 1.24\_02 for Perl parse the trailer in quadratic time (no CVSS, HTTP-Body)
- [CVE-2026-121824](https://cve.now/CVE-2026-121824.md): A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive… (CVSS 8.7, LY Armeria)
- [CVE-2026-121823](https://cve.now/CVE-2026-121823.md): A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow… (CVSS 8.7, LY Armeria)
- [CVE-2026-121822](https://cve.now/CVE-2026-121822.md): A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored… (CVSS 2.4, LY Armeria)
- [CVE-2026-121821](https://cve.now/CVE-2026-121821.md): A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured… (CVSS 5.3, LY Armeria)
- [CVE-2026-121820](https://cve.now/CVE-2026-121820.md): A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses… (CVSS 8.7, LY Armeria)
- [CVE-2026-121819](https://cve.now/CVE-2026-121819.md): A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment… (CVSS 5.9, LY Armeria)
- [CVE-2026-121636](https://cve.now/CVE-2026-121636.md): Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter (CVSS 5.3, Quick Event Manager)
- [CVE-2026-121633](https://cve.now/CVE-2026-121633.md): Order Tracking \< 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener (CVSS 5.3, Order Tracking)
- [CVE-2026-118166](https://cve.now/CVE-2026-118166.md): MC4WP: Mailchimp for WordPress \< 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag (CVSS 4.8, MC4WP: Mailchimp for WordPress)
- [CVE-2026-118423](https://cve.now/CVE-2026-118423.md): WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload (CVSS 10.0, WP Libre Form)
- [CVE-2026-88801](https://cve.now/CVE-2026-88801.md): MDJM Event Management and Mobile Events Manager \<= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation (CVSS 8.0, MDJM Event Management · Mobile Events Manager)
- [CVE-2026-88800](https://cve.now/CVE-2026-88800.md): MDJM Event Management and Mobile Events Manager \<= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion (CVSS 9.1, MDJM Event Management · Mobile Events Manager)
- [CVE-2026-88799](https://cve.now/CVE-2026-88799.md): MDJM Event Management and Mobile Events Manager \<= 1.7.8.7 - Subscriber+ Account Takeover via IDOR (CVSS 8.8, MDJM Event Management · Mobile Events Manager)
- [CVE-2026-120749](https://cve.now/CVE-2026-120749.md): Dbus: dbus-daemon: dbus-daemon aborts (reply\_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus (CVSS 6.2, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-83494](https://cve.now/CVE-2026-83494.md): Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug) (no CVSS, Red Hat OpenShift AI)
- [CVE-2026-83493](https://cve.now/CVE-2026-83493.md): Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master (CVSS 9.1, Red Hat OpenShift AI)
- [CVE-2026-9797](https://cve.now/CVE-2026-9797.md): Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator (CVSS 6.5, Red Hat Build of Keycloak)
- [CVE-2026-73473](https://cve.now/CVE-2026-73473.md): Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of service (CVSS 5.5, GStreamer gst-plugins-good)
- [CVE-2026-73472](https://cve.now/CVE-2026-73472.md): Gstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds read (CVSS 6.1, GStreamer gst-plugins-good)
- [CVE-2026-73471](https://cve.now/CVE-2026-73471.md): Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsing (CVSS 6.1, GStreamer gst-plugins-good)
- [CVE-2026-97848](https://cve.now/CVE-2026-97848.md): Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization (CVSS 6.5, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-97367](https://cve.now/CVE-2026-97367.md): Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover (CVSS 6.4, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-96547](https://cve.now/CVE-2026-96547.md): Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm\_access.roles (CVSS 6.5, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-96460](https://cve.now/CVE-2026-96460.md): Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2 (CVSS 5.4, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-92856](https://cve.now/CVE-2026-92856.md): Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints (CVSS 4.9, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-19688](https://cve.now/CVE-2026-19688.md): Keycloak-services: keycloak-services: admin api missing audience check (CVSS 6.8, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-96447](https://cve.now/CVE-2026-96447.md): Keycloak-services: keycloak-services: stateless token preferred\_username fallback enables identity rebinding (CVSS 4.2, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-118239](https://cve.now/CVE-2026-118239.md): AutomatorWP \< 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback (CVSS 5.6, AutomatorWP)
- [CVE-2026-118188](https://cve.now/CVE-2026-118188.md): PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure (CVSS 4.3, PublishPress Revisions: Duplicate Posts, Submit, Approve an…)
- [CVE-2026-118187](https://cve.now/CVE-2026-118187.md): PublishPress Revisions \< 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR (CVSS 2.7, PublishPress Revisions: Duplicate Posts, Submit, Approve an…)
- [CVE-2026-118186](https://cve.now/CVE-2026-118186.md): PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow (CVSS 4.9, PublishPress Revisions: Duplicate Posts, Submit, Approve an…)
- [CVE-2026-118167](https://cve.now/CVE-2026-118167.md): MC4WP: Mailchimp for WordPress \< 4.15.0 - Unauthenticated Subscription Audience Override (CVSS 5.3, MC4WP: Mailchimp for WordPress)
- [CVE-2026-115673](https://cve.now/CVE-2026-115673.md): Anti-Spam by CleanTalk \< 6.91 - Unauthenticated Stored XSS via Comment Author Email (CVSS 7.5, Anti-Spam, Spam FireWall by CleanTalk)
- [CVE-2026-113615](https://cve.now/CVE-2026-113615.md): GS JWT Authentication \<= 1.0.0 - Unauthenticated Privilege Escalation via SQLi (CVSS 9.8, GS JWT Authentication for WP REST API)
- [CVE-2026-110813](https://cve.now/CVE-2026-110813.md): Advanced Custom Fields (ACF®) \< 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection (CVSS 7.5, Advanced Custom Fields)
- [CVE-2026-92396](https://cve.now/CVE-2026-92396.md): Blocks for ShopEngine \< 2.4.4 - Contributor+ Stored XSS via gutenova\_store\_css (CVSS 6.8, ShopEngine Gutenberg WooCommerce Builder Blocks Addon)
- [CVE-2026-87784](https://cve.now/CVE-2026-87784.md): Cool Media Filter \<= 1.0.1 - Subscriber+ Privilege Escalation via role\_permission (CVSS 8.8, Cool Media Filter)
- [CVE-2026-86606](https://cve.now/CVE-2026-86606.md): iubenda \< 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser (CVSS 7.5, iubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…)
- [CVE-2026-12967](https://cve.now/CVE-2026-12967.md): WCFM Membership \< 2.12.1 - Subscriber+ Payment Verification Bypass (CVSS 6.5, WCFM Membership)
- [CVE-2026-120408](https://cve.now/CVE-2026-120408.md): All-in-One Video Gallery \< 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta (CVSS 8.0, All-in-One Video Gallery)
- [CVE-2026-119259](https://cve.now/CVE-2026-119259.md): All-in-One Video Gallery \< 5.1.0 - Unauthenticated Views and Duration Post Meta Write (CVSS 5.3, All-in-One Video Gallery)
- [CVE-2026-118639](https://cve.now/CVE-2026-118639.md): Surfer \< 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure (CVSS 6.5, Surfer)
- [CVE-2026-118045](https://cve.now/CVE-2026-118045.md): Ever Accounting \< 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import (CVSS 8.7, Ever Accounting)
- [CVE-2026-116533](https://cve.now/CVE-2026-116533.md): Static Snapshot \<= 0.2.1 - Unauthenticated RCE via 'name' Parameter (CVSS 9.8, Static Snapshot)
- [CVE-2026-115230](https://cve.now/CVE-2026-115230.md): WHIZZ \<= 1.1.8 - Unauthenticated Arbitrary User Password Reset (CVSS 9.8, WHIZZ)
- [CVE-2026-114427](https://cve.now/CVE-2026-114427.md): GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS (CVSS 6.8, GutenKit)
- [CVE-2026-113584](https://cve.now/CVE-2026-113584.md): Real Estate Website Builder \<= 1.4.3 - Unauthenticated Account Takeover via User Email Update (CVSS 9.8, placester)
- [CVE-2026-110955](https://cve.now/CVE-2026-110955.md): Wurdey \<= 1.0.0 - Unauthenticated Administrator Authentication Bypass (CVSS 9.8, Wurdey)
- [CVE-2026-110532](https://cve.now/CVE-2026-110532.md): Mail Mage \<= 0.0.25 - Unauthenticated SQLi via 'ewp\_unsubscribe' Parameter (CVSS 8.6, Mail Mage)
- [CVE-2026-110525](https://cve.now/CVE-2026-110525.md): MCB Stats \<= 1.0.0 - Unauthenticated Stored XSS via User-Agent (CVSS 8.8, MCB)
- [CVE-2026-109081](https://cve.now/CVE-2026-109081.md): Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint (CVSS 6.8, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-107124](https://cve.now/CVE-2026-107124.md): Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id\_token\_hint leading to account takeover (CVSS 6.4, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-121837](https://cve.now/CVE-2026-121837.md): Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort (CVSS 4.3, Red Hat Exploit Intelligence · Red Hat build of Quarkus)
- [CVE-2026-123037](https://cve.now/CVE-2026-123037.md): Ansible-core: user module generate\_ssh\_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) (CVSS 6.7, Red Hat Migration Toolkit for Applications · Red Hat Mig… +9)
- [CVE-2026-114366](https://cve.now/CVE-2026-114366.md): Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework (CVSS 2.3, Qt Framework)
- [CVE-2026-119432](https://cve.now/CVE-2026-119432.md): Foxit Workspace Stored XSS in shared artifacts (CVSS 8.7, Foxit Software Foxit Workspace)
- [CVE-2026-119431](https://cve.now/CVE-2026-119431.md): Server-Side Request Forgery in Foxit Workspace File Upload (CVSS 7.7, Foxit Software Foxit Workspace)
- [CVE-2026-119433](https://cve.now/CVE-2026-119433.md): Server-Side Request Forgery in Foxit Workspace PDF Export (CVSS 7.7, Foxit Software Foxit Workspace)
- [CVE-2026-89142](https://cve.now/CVE-2026-89142.md): Out-of-bounds Write in Wi-Fi NPU (CVSS 6.3, Airoha Technology EN7529, AN7552, AN7581, AN7583)
- [CVE-2026-77299](https://cve.now/CVE-2026-77299.md): Regexp2: Unbounded memory amplification via large \`{m}\` quantifier on a zero-width subexpression (CVSS 7.5, dlclark regexp2)
- [CVE-2025-71458](https://cve.now/CVE-2025-71458.md): FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo (CVSS 8.7, cern-fts fts-monitoring)
- [CVE-2026-63774](https://cve.now/CVE-2026-63774.md): Subnet Solutions PowerSYSTEM Center SQL Injection (CVSS 9.0, Subnet Solutions PowerSYSTEM Center)
- [CVE-2026-63017](https://cve.now/CVE-2026-63017.md): Subnet Solutions PowerSYSTEM Center Incorrect Authorization (CVSS 9.0, Subnet Solutions PowerSYSTEM Center)
- [CVE-2026-123269](https://cve.now/CVE-2026-123269.md): libyal libvmdk Descriptor File libvmdk\_descriptor\_file.c libvmdk\_descriptor\_file\_read\_header out-of-bounds (CVSS 4.8, libyal libvmdk)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.