# CVEs published 2026-11-09

520 CVEs were published on November 9, 2026: 29 critical, 170 high. 7 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-197290786f](https://cve.now/SZB-197290786f): N-able takes N-central offline after researcher discloses 30+ alleged zero-days
- [SZB-c4c564b6da](https://cve.now/SZB-c4c564b6da): Researcher says AI agent escaped test environment and hacked WorkOS cloud platform
- [SZB-e0d31900bd](https://cve.now/SZB-e0d31900bd): Wiz says attacker breached multiple Qubole customers' AWS accounts
- [SZB-5ab74d9eed](https://cve.now/SZB-5ab74d9eed): Ethersphere's bee-js and Swarm Desktop releases reported to carry wallet-stealing malware
- [SZB-44f5e7b0cb](https://cve.now/SZB-44f5e7b0cb): Attackers exploit 'SSHole' authentication bypass in OpenSSH
- [SZB-ea46f00bd9](https://cve.now/SZB-ea46f00bd9): Web3Auth flaw exploited to drain Keplr wallets, companies say
- [SZB-1fded00034](https://cve.now/SZB-1fded00034): Frontline Education reports August data breach affecting over 3 million people

## CVEs

- [CVE-2026-125077](https://cve.now/CVE-2026-125077.md): SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgery (CVSS 5.3, SourceCodester Smart Attendance System with QR Code Scanner)
- [CVE-2026-125076](https://cve.now/CVE-2026-125076.md): SourceCodester Smart Attendance System with QR Code Scanner JSON Endpoint attendance\_handler.php missing authentication (CVSS 6.9, SourceCodester Smart Attendance System with QR Code Scanner)
- [CVE-2026-125406](https://cve.now/CVE-2026-125406.md): Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling (CVSS 8.7, ettercap)
- [CVE-2026-125405](https://cve.now/CVE-2026-125405.md): Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing (CVSS 7.2, ettercap)
- [CVE-2026-125404](https://cve.now/CVE-2026-125404.md): Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption (CVSS 7.7, ettercap)
- [CVE-2026-125403](https://cve.now/CVE-2026-125403.md): Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw\_remove\_sts (CVSS 7.2, ettercap)
- [CVE-2026-125402](https://cve.now/CVE-2026-125402.md): Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing (CVSS 7.2, ettercap)
- [CVE-2026-125401](https://cve.now/CVE-2026-125401.md): Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector (CVSS 7.2, ettercap)
- [CVE-2026-125400](https://cve.now/CVE-2026-125400.md): Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution (CVSS 8.7, ettercap)
- [CVE-2026-125399](https://cve.now/CVE-2026-125399.md): Fluxion before 6.39 OS Command Injection via Crafted SSID (CVSS 8.6, FluxionNetwork fluxion)
- [CVE-2026-125398](https://cve.now/CVE-2026-125398.md): Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint (CVSS 7.1, CoreBunch Instatic)
- [CVE-2026-125397](https://cve.now/CVE-2026-125397.md): NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Override (CVSS 7.1, nocobase)
- [CVE-2026-125396](https://cve.now/CVE-2026-125396.md): Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery (CVSS 8.5, ArtifexSoftware ghostpdl)
- [CVE-2026-125395](https://cve.now/CVE-2026-125395.md): Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag (CVSS 5.1, ampache)
- [CVE-2026-125394](https://cve.now/CVE-2026-125394.md): FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer (CVSS 5.3, FreeRDP)
- [CVE-2026-125393](https://cve.now/CVE-2026-125393.md): MailEnable Enterprise Premium before 10.62 Heap Overflow via IMAP X-FB-FETCH (CVSS 7.1, MailEnable Enterprise Premium)
- [CVE-2026-125392](https://cve.now/CVE-2026-125392.md): Webmin through 2.670 Stored XSS via BIND8 edit\_recs.cgi ALL View (CVSS 5.1, webmin)
- [CVE-2026-125391](https://cve.now/CVE-2026-125391.md): Webmin through 2.670 OS Command Injection via Samba User Account Options (CVSS 8.6, webmin)
- [CVE-2026-125390](https://cve.now/CVE-2026-125390.md): Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueue (CVSS 7.1, Intermesh Group-Office)
- [CVE-2026-125389](https://cve.now/CVE-2026-125389.md): Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass (CVSS 5.3, Intermesh Group-Office)
- [CVE-2026-125388](https://cve.now/CVE-2026-125388.md): Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download (CVSS 7.1, Intermesh Group-Office)
- [CVE-2026-125387](https://cve.now/CVE-2026-125387.md): Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController (CVSS 5.3, faveosuite faveo-helpdesk)
- [CVE-2026-125386](https://cve.now/CVE-2026-125386.md): langchain4j-aideepin through 3.32.0 IDOR via /character/message reference endpoints (CVSS 6.0, moyangzhan langchain4j-aideepin)
- [CVE-2026-125385](https://cve.now/CVE-2026-125385.md): INDOTALENT WHMS before 10.20261109 Path Traversal via FileDocument/GetDocument and FileImage/GetImage (CVSS 7.1, go2ismail Asp.Net-Core-Inventory-Order-Management-System)
- [CVE-2026-125384](https://cve.now/CVE-2026-125384.md): INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder (CVSS 9.3, go2ismail Asp.Net-Core-Inventory-Order-Management-System)
- [CVE-2026-125383](https://cve.now/CVE-2026-125383.md): INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass (CVSS 9.3, go2ismail Asp.Net-Core-Inventory-Order-Management-System)
- [CVE-2026-125382](https://cve.now/CVE-2026-125382.md): Map-OS 5.0.0 to before 5.2.2 Privilege Escalation via /api/v1/usuarios (CVSS 8.6, RamonSilva20 mapos)
- [CVE-2026-125381](https://cve.now/CVE-2026-125381.md): DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql (CVSS 6.0, gcpaas DataRoom)
- [CVE-2026-125380](https://cve.now/CVE-2026-125380.md): DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test (CVSS 7.1, gcpaas DataRoom)
- [CVE-2026-125379](https://cve.now/CVE-2026-125379.md): Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read (CVSS 2.3, movim)
- [CVE-2026-125378](https://cve.now/CVE-2026-125378.md): PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint (CVSS 5.3, PowerDNS-Admin)
- [CVE-2026-125377](https://cve.now/CVE-2026-125377.md): Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client (CVSS 7.1, pig-mesh pig)
- [CVE-2026-125376](https://cve.now/CVE-2026-125376.md): VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint (CVSS 6.9, Mereithhh vanblog)
- [CVE-2026-125375](https://cve.now/CVE-2026-125375.md): MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers (CVSS 5.3, zmister2016 MrDoc)
- [CVE-2026-125374](https://cve.now/CVE-2026-125374.md): Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach (CVSS 5.3, krayin laravel-crm)
- [CVE-2026-125373](https://cve.now/CVE-2026-125373.md): IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views (CVSS 5.3, ietf-tools datatracker)
- [CVE-2026-125372](https://cve.now/CVE-2026-125372.md): REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints (CVSS 5.3, getrebuild rebuild)
- [CVE-2026-125371](https://cve.now/CVE-2026-125371.md): Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match (CVSS 6.3, tinyproxy)
- [CVE-2026-125370](https://cve.now/CVE-2026-125370.md): Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret (CVSS 9.3, kubero-dev kubero)
- [CVE-2026-125369](https://cve.now/CVE-2026-125369.md): Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups (CVSS 6.9, fsinfuhh Bitpoll)
- [CVE-2026-125368](https://cve.now/CVE-2026-125368.md): OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist (CVSS 7.7, YeQing17-2026 OmniAgent)
- [CVE-2026-125367](https://cve.now/CVE-2026-125367.md): Pico through 4.1.2 SSRF in Feeds Service via run SSH Command (CVSS 5.3, picosh pico)
- [CVE-2026-125366](https://cve.now/CVE-2026-125366.md): Omnom through 0.9.0 SSRF via Add Feed /add\_feed Route (CVSS 5.3, asciimoo omnom)
- [CVE-2026-125365](https://cve.now/CVE-2026-125365.md): DollarDollar through 4.4 Missing Authorization in /add\_expense Balance Tampering (CVSS 7.1, harung1993 dollardollar)
- [CVE-2026-125364](https://cve.now/CVE-2026-125364.md): frab through 0.9.1 Privilege Escalation via conference\_users\_attributes in UsersController (CVSS 8.6, frab)
- [CVE-2026-125363](https://cve.now/CVE-2026-125363.md): MikroDash before 0.8.79 SSRF via Personal Notification Channels (CVSS 5.3, SecOps-7 MikroDash)
- [CVE-2026-125362](https://cve.now/CVE-2026-125362.md): Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint (CVSS 2.3, haiwen seahub)
- [CVE-2026-125361](https://cve.now/CVE-2026-125361.md): Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport (CVSS 7.2, Tencent BrowserSkill)
- [CVE-2026-125360](https://cve.now/CVE-2026-125360.md): Storyden through 1.26.16 Privilege Escalation via MANAGE\_ROLES Role Assignment (CVSS 8.6, Southclaws storyden)
- [CVE-2026-125359](https://cve.now/CVE-2026-125359.md): Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting (CVSS 5.3, fancydirty mediary-scout)
- [CVE-2026-125358](https://cve.now/CVE-2026-125358.md): Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink (CVSS 7.2, rehan-remade universal-modder)
- [CVE-2026-125357](https://cve.now/CVE-2026-125357.md): Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler (CVSS 6.9, munin-monitoring munin)
- [CVE-2026-117477](https://cve.now/CVE-2026-117477.md): KUSANAGI provided by GMO Prime Strategy Co., Ltd. (CVSS 6.1, GMO Prime Strategy Co. KUSANAGI 7 Security Edition · GM… +13)
- [CVE-2026-125075](https://cve.now/CVE-2026-125075.md): SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create\_admin.php getMessage missing authentication (CVSS 6.9, SourceCodester Smart Attendance System with QR Code Scanner)
- [CVE-2026-115934](https://cve.now/CVE-2026-115934.md): SQL injection leading to privilege escalation (CVSS 9.3, craftcms/cms)
- [CVE-2026-125074](https://cve.now/CVE-2026-125074.md): SourceCodester Smart Attendance System with QR Code Scanner Password Reset reset\_password.php password recovery (CVSS 6.9, SourceCodester Smart Attendance System with QR Code Scanner)
- [CVE-2026-125120](https://cve.now/CVE-2026-125120.md): Mongoose: sanitizeFilter not applied on countDocuments (CVSS 9.8, Automattic mongoose)
- [CVE-2026-125119](https://cve.now/CVE-2026-125119.md): Mongoose: Connection-level sanitizeFilter not applied (CVSS 7.5, Automattic mongoose)
- [CVE-2026-125118](https://cve.now/CVE-2026-125118.md): Mongoose: Prototype pollution via Schema.prototype.virtual() (CVSS 6.5, Automattic mongoose)
- [CVE-2026-124035](https://cve.now/CVE-2026-124035.md): Unsafe reflection in Amazon Braket Schemas error mitigation validation (CVSS 7.1, amazon-braket-schemas)
- [CVE-2026-124034](https://cve.now/CVE-2026-124034.md): Path traversal in Amazon Braket SDK local hybrid job input data download (CVSS 6.4, AWS amazon-braket-sdk)
- [CVE-2026-125117](https://cve.now/CVE-2026-125117.md): Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of… (CVSS 8.2, Automattic mongoose)
- [CVE-2026-125116](https://cve.now/CVE-2026-125116.md): Mongoose: Discriminator key values matching inherited properties (e.g. \_\_t: 'constructor') bypass schema casting and can poison collections (CVSS 4.8, Automattic mongoose)
- [CVE-2026-125115](https://cve.now/CVE-2026-125115.md): Novu: \`validateUrlSsrf\` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition (CVSS 6.8, novuhq novu · @novu application-generic +1)
- [CVE-2026-125114](https://cve.now/CVE-2026-125114.md): Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection (CVSS 8.3, novuhq novu)
- [CVE-2026-125113](https://cve.now/CVE-2026-125113.md): XRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern (CVSS 5.3, xrootd)
- [CVE-2026-125112](https://cve.now/CVE-2026-125112.md): djust: A template binding inherits a context safety grant it never earned (XSS) (CVSS 2.3, djust-org djust)
- [CVE-2026-90591](https://cve.now/CVE-2026-90591.md): NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop (CVSS 7.5, zephyrproject zephyr)
- [CVE-2026-90590](https://cve.now/CVE-2026-90590.md): Permanent loss of transmit capability in the NXP ENET QoS Ethernet driver after an Ethernet link drop (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-90589](https://cve.now/CVE-2026-90589.md): Memory-mapped thread stack is never unmapped when a thread is aborted by another thread, exhausting kernel virtual address space (CVSS 5.5, zephyrproject zephyr)
- [CVE-2026-90588](https://cve.now/CVE-2026-90588.md): Out-of-bounds read in Zephyr HTTP client debug logging of response header fields (CVSS 3.7, zephyrproject zephyr)
- [CVE-2026-90587](https://cve.now/CVE-2026-90587.md): NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-90586](https://cve.now/CVE-2026-90586.md): Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-90585](https://cve.now/CVE-2026-90585.md): Renesas RA SCI UART driver: unacknowledged receive-error interrupt causes a permanent interrupt storm and CPU lockup (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-125111](https://cve.now/CVE-2026-125111.md): Rack: Multipart parsing allows DoS via unbounded scan buffer growth (CVSS 7.5, rack)
- [CVE-2026-125110](https://cve.now/CVE-2026-125110.md): Rack: Rack::Static header\_rules bypass via dot-segment normalization mismatch (CVSS 5.3, rack)
- [CVE-2026-124999](https://cve.now/CVE-2026-124999.md): braindecode Hub Integration base.py EEGModuleMixin.\_from\_pretrained path traversal (CVSS 5.3, braindecode)
- [CVE-2026-125109](https://cve.now/CVE-2026-125109.md): Rack: Rack::Request#host\_with\_port (and #base\_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835 (CVSS 4.8, rack)
- [CVE-2026-125108](https://cve.now/CVE-2026-125108.md): Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass (CVSS 3.7, rack)
- [CVE-2026-77473](https://cve.now/CVE-2026-77473.md): AsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied Filenames (CVSS 6.5, ronf asyncssh)
- [CVE-2026-102643](https://cve.now/CVE-2026-102643.md): AsyncSSH: SFTPServer Chroot Escape (CVSS 8.8, ronf asyncssh)
- [CVE-2026-124996](https://cve.now/CVE-2026-124996.md): Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing\_sel\_norm\_kernel out-of-bounds (CVSS 5.3, Turboderp-org ExLlamaV3)
- [CVE-2026-102289](https://cve.now/CVE-2026-102289.md): zizmor: Debug logging prints available GitHub credentials in cleartext (CVSS 7.0, zizmorcore zizmor · zizmor)
- [CVE-2026-61812](https://cve.now/CVE-2026-61812.md): ModSecurity: HTML decoder missing entities, leading to evasion (CVSS 6.3, owasp-modsecurity ModSecurity)
- [CVE-2026-73857](https://cve.now/CVE-2026-73857.md): ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability (CVSS 7.5, owasp-modsecurity ModSecurity)
- [CVE-2026-104259](https://cve.now/CVE-2026-104259.md): ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypass (CVSS 5.4, owasp-modsecurity ModSecurity)
- [CVE-2026-114032](https://cve.now/CVE-2026-114032.md): Local privilege escalation via untrusted OpenSSL configuration (CVSS 7.8, Illumio Core Ven)
- [CVE-2026-114031](https://cve.now/CVE-2026-114031.md): Local privilege escalation via insecure folder permissions (CVSS 7.8, Illumio Core Ven)
- [CVE-2026-125107](https://cve.now/CVE-2026-125107.md): Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key (CVSS 7.5, julianhille MuhammaraJS)
- [CVE-2026-125106](https://cve.now/CVE-2026-125106.md): Wagtail: Improper restriction handling on Page translation API endpoint (CVSS 6.5, wagtail)
- [CVE-2026-125105](https://cve.now/CVE-2026-125105.md): Wagtail: Identification of documents by SHA1 hash (CVSS 3.7, wagtail)
- [CVE-2026-123820](https://cve.now/CVE-2026-123820.md): Wagtail: Improper restriction handling on descendant collections in Documents and Images API (CVSS 5.3, wagtail)
- [CVE-2026-63644](https://cve.now/CVE-2026-63644.md): bird-lg-go: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') and Exposure of Sensitive Information to an… (CVSS 7.5, xddxdd bird-lg-go)
- [CVE-2026-123819](https://cve.now/CVE-2026-123819.md): Wagtail: Improper permission handling when copying snippets (CVSS 6.5, wagtail)
- [CVE-2026-123818](https://cve.now/CVE-2026-123818.md): LMDeploy URL parser disagreement permits SSRF filter bypass (CVSS 7.5, InternLM lmdeploy · lmdeploy)
- [CVE-2026-123817](https://cve.now/CVE-2026-123817.md): AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads (CVSS 8.7, aio-libs aiohttp)
- [CVE-2026-115864](https://cve.now/CVE-2026-115864.md): Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory (no CVSS, Monoceros)
- [CVE-2026-123816](https://cve.now/CVE-2026-123816.md): pyLoad: Authentication bypass in API key validation (check\_apikey cache) (CVSS 8.1, pyload)
- [CVE-2026-123815](https://cve.now/CVE-2026-123815.md): pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) (CVSS 9.4, pyload · pyload-ng)
- [CVE-2026-123814](https://cve.now/CVE-2026-123814.md): pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host (CVSS 6.4, pyload · pyload-ng)
- [CVE-2026-123813](https://cve.now/CVE-2026-123813.md): pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session (CVSS 7.5, pyload · pyload-ng)
- [CVE-2026-124033](https://cve.now/CVE-2026-124033.md): Relative path traversal in the log export commands in AWS ParallelCluster CLI (CVSS 6.4, aws-parallelcluster)
- [CVE-2026-123812](https://cve.now/CVE-2026-123812.md): Dynatrace MCP Server: create\_dynatrace\_notebook missing the human-approval gate (CVSS 3.7, dynatrace-oss dynatrace-mcp)
- [CVE-2026-123811](https://cve.now/CVE-2026-123811.md): Dynatrace MCP Server: Unauthenticated HTTP MCP Tool Invocation in \`@dynatrace-oss/dynatrace-mcp-server\` (CVSS 7.5, dynatrace-oss dynatrace-mcp)
- [CVE-2026-63634](https://cve.now/CVE-2026-63634.md): pympp: Gas Draining with padding (CVSS 6.9, tempoxyz pympp)
- [CVE-2026-123810](https://cve.now/CVE-2026-123810.md): Dynatrace MCP Server: DQL injection via parameters not documented as DQL (CVSS 4.3, dynatrace-oss dynatrace-mcp)
- [CVE-2026-63496](https://cve.now/CVE-2026-63496.md): augment-vir: Shell Command Injection in \`grep()\` via Unsanitized \`searchPattern\` (CVSS 7.8, electrovir augment-vir)
- [CVE-2026-123809](https://cve.now/CVE-2026-123809.md): Dynatrace MCP Server: Workflow template injection via create\_workflow\_for\_notification (CVSS 4.2, dynatrace-oss dynatrace-mcp)
- [CVE-2026-63497](https://cve.now/CVE-2026-63497.md): titra: residual mass assignment via customfields in timeentry/create and project/task/create (CVSS 5.3, titraio titra)
- [CVE-2026-124994](https://cve.now/CVE-2026-124994.md): Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram\_dequant out-of-bounds (CVSS 5.3, Turboderp-org ExLlamaV3)
- [CVE-2026-123808](https://cve.now/CVE-2026-123808.md): Nuxt UI: UAuthForm / UForm SSR markup omits \`method\`, leaking credentials via GET if submitted before hydration (CVSS 5.3, nuxt ui)
- [CVE-2026-123807](https://cve.now/CVE-2026-123807.md): Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and… (CVSS 9.8, signalk-server · @signalk resources-provider)
- [CVE-2026-122056](https://cve.now/CVE-2026-122056.md): Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-124992](https://cve.now/CVE-2026-124992.md): nushell Data Conversion ser.rs escape\_bytes control sequence (CVSS 4.8, nushell)
- [CVE-2026-119759](https://cve.now/CVE-2026-119759.md): TrailBase 0.28.2 \< 0.35.10 IDOR via Record API File Column (CVSS 8.6, trailbaseio trailbase)
- [CVE-2026-113971](https://cve.now/CVE-2026-113971.md): This issue was addressed by restricting options offered on a locked device. (CVSS 3.5, Apple iOS and iPadOS)
- [CVE-2026-113970](https://cve.now/CVE-2026-113970.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-113969](https://cve.now/CVE-2026-113969.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-113968](https://cve.now/CVE-2026-113968.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-113965](https://cve.now/CVE-2026-113965.md): This issue was addressed with improved checks. (CVSS 5.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-113964](https://cve.now/CVE-2026-113964.md): A logic issue was addressed with improved state management. (CVSS 5.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-113963](https://cve.now/CVE-2026-113963.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS +1)
- [CVE-2026-113961](https://cve.now/CVE-2026-113961.md): An authorization issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-113960](https://cve.now/CVE-2026-113960.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-56712](https://cve.now/CVE-2026-56712.md): Replicate Cog 0.23.1 SSRF via cog.File and cog.Path URL Inputs (CVSS 6.3, replicate cog)
- [CVE-2026-123806](https://cve.now/CVE-2026-123806.md): python-tuf: Platform-dependent delegation path matching (CVSS 4.0, theupdateframework python-tuf · tuf)
- [CVE-2026-84410](https://cve.now/CVE-2026-84410.md): apport: Local privilege escalation to root via ldd execution on an attacker-controlled ExecutablePath in automatic crash report processing (CVSS 7.3, Canonical apport)
- [CVE-2026-86692](https://cve.now/CVE-2026-86692.md): apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys (CVSS 5.7, Canonical apport)
- [CVE-2026-119078](https://cve.now/CVE-2026-119078.md): Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys (no CVSS, Apache Software Foundation commons-codec:commons-codec)
- [CVE-2026-124077](https://cve.now/CVE-2026-124077.md): Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class) (low (no CVSS), Apache Software Foundation commons-codec:commons-codec · Ap…)
- [CVE-2026-123805](https://cve.now/CVE-2026-123805.md): SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS) (CVSS 7.5, sipsorcery-org sipsorcery)
- [CVE-2026-124987](https://cve.now/CVE-2026-124987.md): mikefarah yq encoder\_properties.go Encode escape output (CVSS 5.3, mikefarah yq)
- [CVE-2026-87857](https://cve.now/CVE-2026-87857.md): Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow (CVSS 5.3, Temporal Technologies go.temporal.io/server)
- [CVE-2026-124834](https://cve.now/CVE-2026-124834.md): iomad Password Field company\_user.php store\_temporary\_password information disclosure (CVSS 6.3, iomad)
- [CVE-2026-125270](https://cve.now/CVE-2026-125270.md): FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder (CVSS 5.8, FFmpeg)
- [CVE-2026-125269](https://cve.now/CVE-2026-125269.md): FFmpeg through 9.0.2 Double Free via cbs\_sei\_delete\_message in cbs\_sei.c (CVSS 7.3, FFmpeg)
- [CVE-2026-125268](https://cve.now/CVE-2026-125268.md): FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125267](https://cve.now/CVE-2026-125267.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder (CVSS 8.5, FFmpeg)
- [CVE-2026-125266](https://cve.now/CVE-2026-125266.md): FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23 (CVSS 4.8, FFmpeg)
- [CVE-2026-125265](https://cve.now/CVE-2026-125265.md): FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer (CVSS 5.8, FFmpeg)
- [CVE-2026-125264](https://cve.now/CVE-2026-125264.md): FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count (CVSS 6.8, FFmpeg)
- [CVE-2026-125263](https://cve.now/CVE-2026-125263.md): FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions (CVSS 5.7, FFmpeg)
- [CVE-2026-125262](https://cve.now/CVE-2026-125262.md): FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding (CVSS 8.5, FFmpeg)
- [CVE-2026-125261](https://cve.now/CVE-2026-125261.md): FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c (CVSS 6.9, FFmpeg)
- [CVE-2026-125260](https://cve.now/CVE-2026-125260.md): FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path (CVSS 7.3, FFmpeg)
- [CVE-2026-125259](https://cve.now/CVE-2026-125259.md): FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores\_ks Encoder (CVSS 8.5, FFmpeg)
- [CVE-2026-125258](https://cve.now/CVE-2026-125258.md): FFmpeg through 9.0.2 Division by Zero via dovi\_configure\_ext() in dovi\_rpuenc.c (CVSS 5.7, FFmpeg)
- [CVE-2026-125257](https://cve.now/CVE-2026-125257.md): FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search (CVSS 7.3, FFmpeg)
- [CVE-2026-125256](https://cve.now/CVE-2026-125256.md): FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff\_bytes Routine (CVSS 7.3, FFmpeg)
- [CVE-2026-125255](https://cve.now/CVE-2026-125255.md): FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding (CVSS 5.8, FFmpeg)
- [CVE-2026-125254](https://cve.now/CVE-2026-125254.md): FFmpeg through 9.0.2 Division by Zero via VVC ff\_vvc\_slice\_rpl() (CVSS 6.8, FFmpeg)
- [CVE-2026-125253](https://cve.now/CVE-2026-125253.md): FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read (CVSS 5.8, FFmpeg)
- [CVE-2026-125252](https://cve.now/CVE-2026-125252.md): FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers (CVSS 5.7, FFmpeg)
- [CVE-2026-125251](https://cve.now/CVE-2026-125251.md): FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c (CVSS 7.3, FFmpeg)
- [CVE-2026-125250](https://cve.now/CVE-2026-125250.md): FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk\_buf Remap (CVSS 8.5, FFmpeg)
- [CVE-2026-125249](https://cve.now/CVE-2026-125249.md): FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing (CVSS 7.3, FFmpeg)
- [CVE-2026-125248](https://cve.now/CVE-2026-125248.md): FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer (CVSS 7.3, FFmpeg)
- [CVE-2026-125247](https://cve.now/CVE-2026-125247.md): FFmpeg through 9.0.2 Integer Overflow via dng\_decode\_tiles() in libavcodec/tiff.c (CVSS 4.8, FFmpeg)
- [CVE-2026-125246](https://cve.now/CVE-2026-125246.md): FFmpeg through 9.0.2 Assertion Failure DoS via cbs\_jpeg\_assemble\_fragment (CVSS 5.7, FFmpeg)
- [CVE-2026-125245](https://cve.now/CVE-2026-125245.md): FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding (CVSS 5.7, FFmpeg)
- [CVE-2026-125244](https://cve.now/CVE-2026-125244.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh\_entry\_points (CVSS 8.5, FFmpeg)
- [CVE-2026-125243](https://cve.now/CVE-2026-125243.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125242](https://cve.now/CVE-2026-125242.md): FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table (CVSS 5.7, FFmpeg)
- [CVE-2026-125241](https://cve.now/CVE-2026-125241.md): FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check\_pixel\_ptr (CVSS 7.3, FFmpeg)
- [CVE-2026-125240](https://cve.now/CVE-2026-125240.md): FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper (CVSS 6.8, FFmpeg)
- [CVE-2026-125239](https://cve.now/CVE-2026-125239.md): FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters (CVSS 7.3, FFmpeg)
- [CVE-2026-125238](https://cve.now/CVE-2026-125238.md): FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper (CVSS 6.8, FFmpeg)
- [CVE-2026-125237](https://cve.now/CVE-2026-125237.md): FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path (CVSS 5.7, FFmpeg)
- [CVE-2026-125236](https://cve.now/CVE-2026-125236.md): FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc\_frame() (CVSS 4.8, FFmpeg)
- [CVE-2026-125235](https://cve.now/CVE-2026-125235.md): FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit\_frame() (CVSS 7.3, FFmpeg)
- [CVE-2026-125234](https://cve.now/CVE-2026-125234.md): FFmpeg through 9.0.2 WavPack Encoder Integer Overflow Infinite Loop via wavpack\_encode\_init (CVSS 6.8, FFmpeg)
- [CVE-2026-125233](https://cve.now/CVE-2026-125233.md): FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder (CVSS 8.5, FFmpeg)
- [CVE-2026-125232](https://cve.now/CVE-2026-125232.md): FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation (CVSS 6.8, FFmpeg)
- [CVE-2026-125231](https://cve.now/CVE-2026-125231.md): FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx\_decode\_header() (CVSS 6.8, FFmpeg)
- [CVE-2026-125230](https://cve.now/CVE-2026-125230.md): FFmpeg through 9.0.2 Integer Overflow Division by Zero via pcm\_rechunk Filter (CVSS 6.8, FFmpeg)
- [CVE-2026-125229](https://cve.now/CVE-2026-125229.md): FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor (CVSS 8.5, FFmpeg)
- [CVE-2026-125228](https://cve.now/CVE-2026-125228.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Out-of-Bounds Read in Vorbis Encoder (CVSS 5.8, FFmpeg)
- [CVE-2026-125227](https://cve.now/CVE-2026-125227.md): FFmpeg through 9.0.2 Heap Buffer Overflow via cbs\_jpeg\_write\_scan Integer Overflow (CVSS 7.3, FFmpeg)
- [CVE-2026-125226](https://cve.now/CVE-2026-125226.md): FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer (CVSS 6.8, FFmpeg)
- [CVE-2026-125225](https://cve.now/CVE-2026-125225.md): FFmpeg through 9.0.2 NULL Pointer Dereference via aac\_adtstoasc Bitstream Filter (CVSS 6.8, FFmpeg)
- [CVE-2026-125224](https://cve.now/CVE-2026-125224.md): FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata (CVSS 6.8, FFmpeg)
- [CVE-2026-125223](https://cve.now/CVE-2026-125223.md): FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9\_decode\_frame (CVSS 5.7, FFmpeg)
- [CVE-2026-125222](https://cve.now/CVE-2026-125222.md): FFmpeg through 9.0.2 Heap Buffer Overflow via hap\_parse\_frame\_header() (CVSS 7.3, FFmpeg)
- [CVE-2026-125221](https://cve.now/CVE-2026-125221.md): FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score\_header() (CVSS 6.8, FFmpeg)
- [CVE-2026-125220](https://cve.now/CVE-2026-125220.md): FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure (CVSS 6.8, FFmpeg)
- [CVE-2026-125219](https://cve.now/CVE-2026-125219.md): FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays (CVSS 7.3, FFmpeg)
- [CVE-2026-125218](https://cve.now/CVE-2026-125218.md): FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode\_apng() (CVSS 7.3, FFmpeg)
- [CVE-2026-125217](https://cve.now/CVE-2026-125217.md): FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure (CVSS 4.8, FFmpeg)
- [CVE-2026-125216](https://cve.now/CVE-2026-125216.md): FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode\_gbrp12() (CVSS 6.8, FFmpeg)
- [CVE-2026-125215](https://cve.now/CVE-2026-125215.md): FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff\_dovi\_rpu\_generate() (CVSS 5.7, FFmpeg)
- [CVE-2026-125214](https://cve.now/CVE-2026-125214.md): FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder (CVSS 7.3, FFmpeg)
- [CVE-2026-125213](https://cve.now/CVE-2026-125213.md): FFmpeg through 9.0.2 Heap Buffer Overflow via PSD Decoder RLE Path (CVSS 7.3, FFmpeg)
- [CVE-2026-125212](https://cve.now/CVE-2026-125212.md): FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder (CVSS 7.3, FFmpeg)
- [CVE-2026-125211](https://cve.now/CVE-2026-125211.md): FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup (CVSS 7.3, FFmpeg)
- [CVE-2026-125210](https://cve.now/CVE-2026-125210.md): FFmpeg through 9.0.2 Heap Overflow in libaribcaption Text Subtitle Decoding (CVSS 7.3, FFmpeg)
- [CVE-2026-125209](https://cve.now/CVE-2026-125209.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c (CVSS 8.5, FFmpeg)
- [CVE-2026-125208](https://cve.now/CVE-2026-125208.md): FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2\_buffers.c (CVSS 7.3, FFmpeg)
- [CVE-2026-125207](https://cve.now/CVE-2026-125207.md): FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-125206](https://cve.now/CVE-2026-125206.md): FFmpeg through 9.0.2 Out-of-Bounds Read via prores\_ks Interlaced Alpha Encoding (CVSS 2.0, FFmpeg)
- [CVE-2026-125205](https://cve.now/CVE-2026-125205.md): FFmpeg through 9.0.2 Memory Exhaustion via av1\_frame\_merge Bitstream Filter (CVSS 6.8, FFmpeg)
- [CVE-2026-125204](https://cve.now/CVE-2026-125204.md): FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment (CVSS 7.3, FFmpeg)
- [CVE-2026-125203](https://cve.now/CVE-2026-125203.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder (CVSS 8.5, FFmpeg)
- [CVE-2026-125202](https://cve.now/CVE-2026-125202.md): FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays (CVSS 7.3, FFmpeg)
- [CVE-2026-125201](https://cve.now/CVE-2026-125201.md): FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 Heap Overflow via vulkan\_av1.c (CVSS 7.3, FFmpeg)
- [CVE-2026-125200](https://cve.now/CVE-2026-125200.md): FFmpeg through 9.0.2 Memory Leak via libx265 Dolby Vision RPU Payloads (CVSS 6.8, FFmpeg)
- [CVE-2026-125199](https://cve.now/CVE-2026-125199.md): FFmpeg through 9.0.2 Memory Leak in VC-1 Decoder via vc1\_decode\_frame() (CVSS 6.8, FFmpeg)
- [CVE-2026-125198](https://cve.now/CVE-2026-125198.md): FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer (CVSS 2.0, FFmpeg)
- [CVE-2026-125197](https://cve.now/CVE-2026-125197.md): FFmpeg through 9.0.2 Heap Out-of-Bounds Read via LCL/ZLIB Multithread Decoding (CVSS 6.9, FFmpeg)
- [CVE-2026-125196](https://cve.now/CVE-2026-125196.md): FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper (CVSS 7.3, FFmpeg)
- [CVE-2026-125195](https://cve.now/CVE-2026-125195.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via ADPCM\_MS Trellis Encoding (CVSS 2.0, FFmpeg)
- [CVE-2026-125194](https://cve.now/CVE-2026-125194.md): FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder (CVSS 6.8, FFmpeg)
- [CVE-2026-125193](https://cve.now/CVE-2026-125193.md): FFmpeg through 9.0.2 Out-of-Bounds Read via bitpacked\_decode\_uyvy422() (CVSS 6.9, FFmpeg)
- [CVE-2026-125192](https://cve.now/CVE-2026-125192.md): FFmpeg through 9.0.2 Heap Memory Disclosure via DXA Decoder Uninitialized Buffer (CVSS 4.8, FFmpeg)
- [CVE-2026-125191](https://cve.now/CVE-2026-125191.md): FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak (CVSS 5.7, FFmpeg)
- [CVE-2026-125190](https://cve.now/CVE-2026-125190.md): FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125189](https://cve.now/CVE-2026-125189.md): FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc\_metadata Bitstream Filter (CVSS 5.7, FFmpeg)
- [CVE-2026-125188](https://cve.now/CVE-2026-125188.md): FFmpeg through 9.0.2 ProRes prores\_aw Heap Out-of-Bounds Read in Interlaced Encoding (CVSS 2.0, FFmpeg)
- [CVE-2026-125187](https://cve.now/CVE-2026-125187.md): FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta\_encode\_frame() (CVSS 6.8, FFmpeg)
- [CVE-2026-125186](https://cve.now/CVE-2026-125186.md): FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter (CVSS 5.7, FFmpeg)
- [CVE-2026-125185](https://cve.now/CVE-2026-125185.md): FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points (CVSS 6.8, FFmpeg)
- [CVE-2026-125184](https://cve.now/CVE-2026-125184.md): FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c (CVSS 4.8, FFmpeg)
- [CVE-2026-125183](https://cve.now/CVE-2026-125183.md): FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing (CVSS 6.8, FFmpeg)
- [CVE-2026-125182](https://cve.now/CVE-2026-125182.md): FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js\_subband\_start (CVSS 4.8, FFmpeg)
- [CVE-2026-125181](https://cve.now/CVE-2026-125181.md): FFmpeg through 9.0.2 FLIC Decoder Out-of-Bounds Write via FLI\_BRUN Byte Swap (CVSS 7.3, FFmpeg)
- [CVE-2026-125180](https://cve.now/CVE-2026-125180.md): FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags (CVSS 6.8, FFmpeg)
- [CVE-2026-125179](https://cve.now/CVE-2026-125179.md): FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125178](https://cve.now/CVE-2026-125178.md): FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions (CVSS 6.9, FFmpeg)
- [CVE-2026-125177](https://cve.now/CVE-2026-125177.md): FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via MSCC/SRGC Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125176](https://cve.now/CVE-2026-125176.md): FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125175](https://cve.now/CVE-2026-125175.md): FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125174](https://cve.now/CVE-2026-125174.md): FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff\_hap\_set\_chunk\_count() (CVSS 6.8, FFmpeg)
- [CVE-2026-125173](https://cve.now/CVE-2026-125173.md): FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper (CVSS 6.8, FFmpeg)
- [CVE-2026-125172](https://cve.now/CVE-2026-125172.md): FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length (CVSS 6.9, FFmpeg)
- [CVE-2026-125171](https://cve.now/CVE-2026-125171.md): FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c (CVSS 6.9, FFmpeg)
- [CVE-2026-125170](https://cve.now/CVE-2026-125170.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa\_decode\_rle() (CVSS 4.8, FFmpeg)
- [CVE-2026-125104](https://cve.now/CVE-2026-125104.md): FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c (CVSS 6.8, FFmpeg)
- [CVE-2026-125103](https://cve.now/CVE-2026-125103.md): FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125102](https://cve.now/CVE-2026-125102.md): FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c (CVSS 4.8, FFmpeg)
- [CVE-2026-125101](https://cve.now/CVE-2026-125101.md): FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure (CVSS 4.8, FFmpeg)
- [CVE-2026-125100](https://cve.now/CVE-2026-125100.md): FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count (CVSS 4.8, FFmpeg)
- [CVE-2026-125099](https://cve.now/CVE-2026-125099.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125098](https://cve.now/CVE-2026-125098.md): FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk (CVSS 4.8, FFmpeg)
- [CVE-2026-125097](https://cve.now/CVE-2026-125097.md): FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125096](https://cve.now/CVE-2026-125096.md): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder (CVSS 4.8, FFmpeg)
- [CVE-2026-125095](https://cve.now/CVE-2026-125095.md): FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure (CVSS 4.8, FFmpeg)
- [CVE-2026-125073](https://cve.now/CVE-2026-125073.md): FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-125072](https://cve.now/CVE-2026-125072.md): FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder (CVSS 5.7, FFmpeg)
- [CVE-2026-125071](https://cve.now/CVE-2026-125071.md): FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder (CVSS 5.7, FFmpeg)
- [CVE-2026-125070](https://cve.now/CVE-2026-125070.md): FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-125069](https://cve.now/CVE-2026-125069.md): FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder (CVSS 5.7, FFmpeg)
- [CVE-2026-125068](https://cve.now/CVE-2026-125068.md): FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-125067](https://cve.now/CVE-2026-125067.md): FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble\_decode\_frame() (CVSS 6.8, FFmpeg)
- [CVE-2026-125066](https://cve.now/CVE-2026-125066.md): FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-125065](https://cve.now/CVE-2026-125065.md): FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c (CVSS 6.8, FFmpeg)
- [CVE-2026-125064](https://cve.now/CVE-2026-125064.md): FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-112314](https://cve.now/CVE-2026-112314.md): Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112321](https://cve.now/CVE-2026-112321.md): Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth\_gssapi\_init error paths (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112320](https://cve.now/CVE-2026-112320.md): Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112319](https://cve.now/CVE-2026-112319.md): Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112318](https://cve.now/CVE-2026-112318.md): Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112316](https://cve.now/CVE-2026-112316.md): Krb5: mit krb5 kadmind authenticated memory leak dos in xdr\_krb5\_tl\_data() decode failure (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112317](https://cve.now/CVE-2026-112317.md): Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path (CVSS 5.3, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112315](https://cve.now/CVE-2026-112315.md): Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec\_gss buffer decode failure (CVSS 5.3, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-12977](https://cve.now/CVE-2026-12977.md): Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation (CVSS 8.8, Red Hat Fuse · Red Hat JBoss Enterprise Application Plat… +1)
- [CVE-2026-123804](https://cve.now/CVE-2026-123804.md): SuperTokens Core: A session created concurrently with account unlink survives the unlink (CVSS 6.8, supertokens-core)
- [CVE-2026-123803](https://cve.now/CVE-2026-123803.md): SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries (CVSS 8.1, supertokens-core)
- [CVE-2026-124001](https://cve.now/CVE-2026-124001.md): ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR (CVSS 9.2, nasa-jpl ION-DTN)
- [CVE-2026-119079](https://cve.now/CVE-2026-119079.md): Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112323](https://cve.now/CVE-2026-112323.md): Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth\_gssapi\_init requests (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-112322](https://cve.now/CVE-2026-112322.md): Krb5: mit krb5 kadmind unauthenticated cpu dos via auth\_gssapi client states cleanup (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-124000](https://cve.now/CVE-2026-124000.md): ION-DTN 2.1.0-4.2.0 Heap Buffer Under-allocation DoS in amsd (CVSS 6.9, nasa-jpl ION-DTN)
- [CVE-2026-123999](https://cve.now/CVE-2026-123999.md): ION-DTN 3.6.2-4.2.0 Heap Buffer Overflow via nm\_mgr AMP Rendering (CVSS 8.7, nasa-jpl ION-DTN)
- [CVE-2026-70555](https://cve.now/CVE-2026-70555.md): rConfig Core 8.2.3 \< 8.2.13 Cleartext Credential Exposure via API (CVSS 7.1, rConfig)
- [CVE-2026-123802](https://cve.now/CVE-2026-123802.md): SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user (CVSS 8.1, supertokens-core)
- [CVE-2026-123801](https://cve.now/CVE-2026-123801.md): SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay (CVSS 7.4, supertokens-core)
- [CVE-2026-125041](https://cve.now/CVE-2026-125041.md): Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layout (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-125040](https://cve.now/CVE-2026-125040.md): Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-123800](https://cve.now/CVE-2026-123800.md): SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications (CVSS 9.9, supertokens-core)
- [CVE-2026-120834](https://cve.now/CVE-2026-120834.md): WordPress WP2LEADS plugin \<= 3.5.17 - Privilege Escalation vulnerability (CVSS 7.3, Tobias WP2LEADS)
- [CVE-2026-121769](https://cve.now/CVE-2026-121769.md): WordPress WP w3all phpBB plugin \<= 3.1.9 - SQL Injection vulnerability (CVSS 8.5, axew3.com WP w3all phpBB)
- [CVE-2026-121573](https://cve.now/CVE-2026-121573.md): WordPress WP Activity Log plugin \<= 5.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Melapress WP Activity Log)
- [CVE-2026-123799](https://cve.now/CVE-2026-123799.md): SuperTokens Core: Dashboard session tokens are never checked for expiry: \`isValidUserSession\` ignores the stored \`expiry\`, so a… (CVSS 7.4, supertokens-core)
- [CVE-2026-123798](https://cve.now/CVE-2026-123798.md): SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user (CVSS 8.1, supertokens-core)
- [CVE-2026-84503](https://cve.now/CVE-2026-84503.md): Ansible-core: ansible-core: ansible.builtin.git invokes git without a \`--\` separator, allowing argument injection via a \`-\`-leading… (CVSS 6.7, Red Hat Migration Toolkit for Applications · Red Hat Mi… +12)
- [CVE-2026-123797](https://cve.now/CVE-2026-123797.md): SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement (CVSS 7.5, supertokens-core)
- [CVE-2026-125063](https://cve.now/CVE-2026-125063.md): Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web… (CVSS 4.3, Red Hat Ansible Automation Platform)
- [CVE-2026-60117](https://cve.now/CVE-2026-60117.md): receive\_sharing\_intent 1.4.1-1.9.0 Path Traversal via FileDirectory (CVSS 6.9, KasemJaffer receive\_sharing\_intent)
- [CVE-2026-123796](https://cve.now/CVE-2026-123796.md): compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated \`.env\` (CVSS 2.3, tmatens compose-lint)
- [CVE-2026-123373](https://cve.now/CVE-2026-123373.md): compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output (CVSS 2.3, tmatens compose-lint)
- [CVE-2026-123270](https://cve.now/CVE-2026-123270.md): CVE-2026-123270 (CVSS 9.8, Redpanda Data Connect)
- [CVE-2026-123372](https://cve.now/CVE-2026-123372.md): compose-lint: A pull request can make compose-lint quote a secret from a CI-generated \`.env\` into its findings (CVSS 2.3, tmatens compose-lint)
- [CVE-2026-123371](https://cve.now/CVE-2026-123371.md): compose-lint: A \`.compose-lint.yml\` symlinked outside the project is read, and a parse error quotes part of the target (CVSS 2.3, tmatens compose-lint)
- [CVE-2026-123370](https://cve.now/CVE-2026-123370.md): compose-lint: \`fix --apply\` can delete a line the user did not select, including a security setting (CVSS 5.1, tmatens compose-lint)
- [CVE-2026-123369](https://cve.now/CVE-2026-123369.md): compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action (CVSS 5.3, tmatens compose-lint)
- [CVE-2026-119756](https://cve.now/CVE-2026-119756.md): Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP (CVSS 9.3, arendst Tasmota)
- [CVE-2026-119755](https://cve.now/CVE-2026-119755.md): Tasmota 16.0.0 CSRF via Referer Header Validation Bypass (CVSS 7.5, arendst Tasmota)
- [CVE-2026-123368](https://cve.now/CVE-2026-123368.md): compose-lint: .env read through a symlink outside the project can expose the CI job's environment (CVSS 2.3, tmatens compose-lint)
- [CVE-2026-123367](https://cve.now/CVE-2026-123367.md): ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder (CVSS 7.4, thorvg)
- [CVE-2026-19706](https://cve.now/CVE-2026-19706.md): Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap (CVSS 8.3, Assisted Installer for Red Hat OpenShift Container Platf… +1)
- [CVE-2026-123364](https://cve.now/CVE-2026-123364.md): OctoPrint: Stored XSS via saved connection parameters (CVSS 2.4, OctoPrint)
- [CVE-2026-104989](https://cve.now/CVE-2026-104989.md): Pre-authentication remote code execution in Chaos V-Ray Swarm (CVSS 9.3, Chaos Software V-Ray Swarm)
- [CVE-2026-121576](https://cve.now/CVE-2026-121576.md): WordPress MCP Server for WordPress plugin \<= 2.0.1 - Privilege Escalation vulnerability (CVSS 8.8, AtlasAiDev MCP Server for WordPress)
- [CVE-2026-122664](https://cve.now/CVE-2026-122664.md): WordPress Broadcast Live Video plugin \<= 7.3.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VideoWhisper.com Broadcast Live Video)
- [CVE-2026-123482](https://cve.now/CVE-2026-123482.md): WordPress JetFormBuilder plugin \<= 3.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetFormBuilder)
- [CVE-2026-121612](https://cve.now/CVE-2026-121612.md): WordPress WPBruiser {no- Captcha anti-Spam} plugin \<= 3.6.2 - Broken Authentication vulnerability (CVSS 4.3, WPZOOM WPBruiser {no- Captcha anti-Spam})
- [CVE-2026-115340](https://cve.now/CVE-2026-115340.md): Insecure Storage of Web Transfer Credentials in Progress WS\_FTP Server (CVSS 7.1, Progress Software WS\_FTP Server)
- [CVE-2026-115339](https://cve.now/CVE-2026-115339.md): Unauthenticated XFT Memory Exhaustion in Progress WS\_FTP Server (CVSS 7.5, Progress Software WS\_FTP Server)
- [CVE-2026-115341](https://cve.now/CVE-2026-115341.md): Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS\_FTP Server (CVSS 7.7, Progress Software WS\_FTP Server)
- [CVE-2026-115337](https://cve.now/CVE-2026-115337.md): Folder Permission Bypass in Progress WS\_FTP Server (CVSS 6.3, Progress Software WS\_FTP Server)
- [CVE-2026-115336](https://cve.now/CVE-2026-115336.md): FTP Quota Accounting Bypass in Progress WS\_FTP Server (CVSS 6.5, Progress Software WS\_FTP Server)
- [CVE-2026-115338](https://cve.now/CVE-2026-115338.md): Insecure XFT Transport in Progress WS\_FTP Server (CVSS 8.1, Progress Software WS\_FTP Server)
- [CVE-2026-112165](https://cve.now/CVE-2026-112165.md): Disabled TLS Certificate Validation Enables MITM Attacks (CVSS 6.9, laservideo lasergest)
- [CVE-2026-121690](https://cve.now/CVE-2026-121690.md): CVE-2026-121690 (no CVSS, FrodoBots EarthRover Mini+ firmware)
- [CVE-2026-121689](https://cve.now/CVE-2026-121689.md): CVE-2026-121689 (no CVSS, FrodoBots EarthRover Mini+ firmware)
- [CVE-2026-121688](https://cve.now/CVE-2026-121688.md): CVE-2026-121688 (no CVSS, FrodoBots EarthRover Mini+ firmware)
- [CVE-2026-121687](https://cve.now/CVE-2026-121687.md): CVE-2026-121687 (no CVSS, FrodoBots EarthRover Mini+ firmware)
- [CVE-2026-121686](https://cve.now/CVE-2026-121686.md): CVE-2026-121686 (no CVSS, FrodoBots EarthRover Mini+ firmware)
- [CVE-2026-121685](https://cve.now/CVE-2026-121685.md): CVE-2026-121685 (no CVSS, FrodoBots EarthRover Mini+ firmware)
- [CVE-2026-114594](https://cve.now/CVE-2026-114594.md): Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard Installer (CVSS 5.4, Sandisk Dashboard)
- [CVE-2026-112164](https://cve.now/CVE-2026-112164.md): Hardcoded AES Key Enables Credential Disclosure (CVSS 6.6, laservideo lasergest)
- [CVE-2026-103906](https://cve.now/CVE-2026-103906.md): Disabled TLS Certificate Validation Enables MITM Attacks (CVSS 7.8, am\_automatic\_machines am\_club)
- [CVE-2026-124683](https://cve.now/CVE-2026-124683.md): Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in… (CVSS 8.7, Eclipse Foundation Eclipse Langium)
- [CVE-2026-118492](https://cve.now/CVE-2026-118492.md): In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in… (CVSS 2.0, Eclipse Foundation Eclipse Langium)
- [CVE-2025-10248](https://cve.now/CVE-2025-10248.md): XSS vulnerability in OpenText Filr (CVSS 7.2, OpenText Filr)
- [CVE-2026-124959](https://cve.now/CVE-2026-124959.md): Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write (no CVSS, Spotify Voyager · hnswlib)
- [CVE-2026-124916](https://cve.now/CVE-2026-124916.md): PrestaShop Performance Debug Configuration PHP Code Injection (CVSS 5.4, PrestaShop)
- [CVE-2026-124850](https://cve.now/CVE-2026-124850.md): SQL Injection in Database Migration via Stored Connector Identifiers in flowintel (CVSS 7.3, flowintel)
- [CVE-2026-104620](https://cve.now/CVE-2026-104620.md): PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE) (CVSS 8.5, PackageKit)
- [CVE-2026-124249](https://cve.now/CVE-2026-124249.md): \`http.cookiejar\` applies expired \`Set-Cookie\` to cookie store before policy validation (CVSS 6.3, Python Software Foundation CPython)
- [CVE-2026-119474](https://cve.now/CVE-2026-119474.md): Privilege Escalation in HAVELSAN's Liman Render Engine (CVSS 7.8, HAVELSAN Liman Render Engine)
- [CVE-2026-19552](https://cve.now/CVE-2026-19552.md): ssl.get\_server\_certificate(addr, ca\_certs=...) verifies the chain but never the identity (CVSS 0.0, Python Software Foundation CPython)
- [CVE-2026-124636](https://cve.now/CVE-2026-124636.md): kevquirk PureBlog Page Editor content.php save\_page path traversal (CVSS 5.1, kevquirk PureBlog)
- [CVE-2026-95779](https://cve.now/CVE-2026-95779.md): An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software. (CVSS 8.8, Hewlett Packard Enterprise (HPE) HPE Morpheus Software)
- [CVE-2026-95778](https://cve.now/CVE-2026-95778.md): A remote code execution vulnerability exists in HPE Morpheus Software. (CVSS 8.8, Hewlett Packard Enterprise (HPE) HPE Morpheus Software)
- [CVE-2026-124635](https://cve.now/CVE-2026-124635.md): kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload (CVSS 5.1, kevquirk PureBlog)
- [CVE-2026-124625](https://cve.now/CVE-2026-124625.md): PipraPay Admin Panel pp-functions.php deleteData sql injection (CVSS 5.3, PipraPay)
- [CVE-2026-121841](https://cve.now/CVE-2026-121841.md): Other issue in Firefox for iOS (no CVSS, Mozilla Firefox for iOS)
- [CVE-2026-121843](https://cve.now/CVE-2026-121843.md): Privilege escalation in Firefox for iOS (CVSS 8.8, Mozilla Firefox for iOS)
- [CVE-2026-121842](https://cve.now/CVE-2026-121842.md): Privilege escalation in the Reader View component in Firefox for iOS (CVSS 8.8, Mozilla Firefox for iOS)
- [CVE-2026-16283](https://cve.now/CVE-2026-16283.md): Command Injection in Osbil Technology's Ltd's oPanel (CVSS 8.8, Osbil Technology Ltd.Osbil Technology oPanel)
- [CVE-2026-119743](https://cve.now/CVE-2026-119743.md): pdfmake \< 0.3.14 Shared Cache Access Policy Bypass (CVSS 6.3, bpampuch pdfmake)
- [CVE-2026-119274](https://cve.now/CVE-2026-119274.md): Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS (CVSS 4.8, Infoblox NIOS)
- [CVE-2026-124624](https://cve.now/CVE-2026-124624.md): PipraPay pp-token anti-CSRF pp-adapter.php hash\_hmac hard-coded credentials (CVSS 6.9, PipraPay)
- [CVE-2026-119613](https://cve.now/CVE-2026-119613.md): AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details (CVSS 5.3, ash-project ash\_ai · ash\_ai)
- [CVE-2026-121611](https://cve.now/CVE-2026-121611.md): Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst\_h265\_parse\_vps() multi-hrd workaround loop (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-121601](https://cve.now/CVE-2026-121601.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta\_id and slice index (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-119610](https://cve.now/CVE-2026-119610.md): Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned… (CVSS 8.2, Red Hat Enterprise Linux)
- [CVE-2026-124623](https://cve.now/CVE-2026-124623.md): PipraPay ZIP Archive system-settings-import unrestricted upload (CVSS 5.1, PipraPay)
- [CVE-2026-122673](https://cve.now/CVE-2026-122673.md): WordPress ShopEngine plugin \<= 4.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wpmet ShopEngine)
- [CVE-2026-112205](https://cve.now/CVE-2026-112205.md): Bruteforce Protection Bypass in WidzialniCMS (CVSS 6.9, Fundacja Widzialni WidzialniCMS)
- [CVE-2026-112204](https://cve.now/CVE-2026-112204.md): Reflected XSS in WidzialniCMS (CVSS 5.1, Fundacja Widzialni WidzialniCMS)
- [CVE-2026-110469](https://cve.now/CVE-2026-110469.md): Remote Code Execution via Unrestricted File Upload in WidzialniCMS (CVSS 10.0, Fundacja Widzialni WidzialniCMS)
- [CVE-2026-110468](https://cve.now/CVE-2026-110468.md): Remote Code Execution via Unrestricted File Upload in WidzialniCMS (CVSS 10.0, Fundacja Widzialni WidzialniCMS)
- [CVE-2026-124622](https://cve.now/CVE-2026-124622.md): olivier-ls PHP-FTS Storage.php open toctou (CVSS 4.8, olivier-ls PHP-FTS)
- [CVE-2026-112171](https://cve.now/CVE-2026-112171.md): SQL injection vulnerability in Magistra software (CVSS 4.4, GALENO SISTEMI MAGISTRA)
- [CVE-2026-112170](https://cve.now/CVE-2026-112170.md): Improper verification of downloaded upgrades (CVSS 6.3, GALENO SISTEMI MAGISTRA)
- [CVE-2026-112169](https://cve.now/CVE-2026-112169.md): Undocumented backdoor allows authentication bypass in Magistra software (CVSS 6.1, GALENO SISTEMI MAGISTRA)
- [CVE-2026-112168](https://cve.now/CVE-2026-112168.md): Multiple embedded secrets and weak algorithms in Magistra (CVSS 6.0, GALENO SISTEMI MAGISTRA)
- [CVE-2026-95648](https://cve.now/CVE-2026-95648.md): Privilege Escalation in C-Prot's C-Prot AppDefense (CVSS 8.1, C-Prot AppDefense)
- [CVE-2026-124079](https://cve.now/CVE-2026-124079.md): rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning (CVSS 9.3, rConfig Core · rConfig Pro)
- [CVE-2026-94434](https://cve.now/CVE-2026-94434.md): OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair (CVSS 8.8, TÜBİTAK BİLGEM Software Technologies Research Institute Par…)
- [CVE-2026-120854](https://cve.now/CVE-2026-120854.md): WordPress iubenda plugin \<= 3.13.6 - Denial of Service Attack vulnerability (CVSS 7.5, iubenda)
- [CVE-2026-120856](https://cve.now/CVE-2026-120856.md): WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rymera Web Invoice Gateway for WooCommerce – Invoice Paymen…)
- [CVE-2026-118798](https://cve.now/CVE-2026-118798.md): Multiple sensitive authentication data exposed (CVSS 4.4, CompuGroup Medical Wingesfar)
- [CVE-2026-118795](https://cve.now/CVE-2026-118795.md): AIS stores authorization state in locally modifiable databases (CVSS 5.9, CompuGroup Medical Infantia · CompuGroup Medical Profim +1)
- [CVE-2026-118792](https://cve.now/CVE-2026-118792.md): Default ODBC credentials (CVSS 6.1, CompuGroup Medical Wingesfar)
- [CVE-2026-118791](https://cve.now/CVE-2026-118791.md): Insecure software update mechanism (CVSS 7.2, CompuGroup Medical Wingesfar)
- [CVE-2026-118790](https://cve.now/CVE-2026-118790.md): Multiple Hardcoded Credentials (CVSS 7.2, CompuGroup Medical Wingesfar)
- [CVE-2026-118468](https://cve.now/CVE-2026-118468.md): AIS XML parsers allow external entity resolution (CVSS 7.2, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118467](https://cve.now/CVE-2026-118467.md): AIS products expose clinical and personal data via logs and telemetry (CVSS 4.3, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118465](https://cve.now/CVE-2026-118465.md): AIS products use vendor-wide hard-coded database credentials (CVSS 5.8, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118464](https://cve.now/CVE-2026-118464.md): AIS shared cryptographic services use fixed cryptographic secrets (CVSS 5.8, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118462](https://cve.now/CVE-2026-118462.md): AIS update mechanism executes unverified code (CVSS 9.2, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118461](https://cve.now/CVE-2026-118461.md): AIS PersonnelService client performs unauthenticated doctor-specific operations (CVSS 8.0, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118460](https://cve.now/CVE-2026-118460.md): AIS embedded private keys enable practitioner impersonation (CVSS 8.0, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118459](https://cve.now/CVE-2026-118459.md): AIS PasswordSOS permits authentication without legitimate credentials (CVSS 6.3, CompuGroup Medical Infantia · CompuGroup Medical Profim +2)
- [CVE-2026-118458](https://cve.now/CVE-2026-118458.md): AIS shared test login provider contains fixed administrative credentials (CVSS 8.1, CompuGroup Medical Phronesis · CompuGroup Medical Venere)
- [CVE-2026-118450](https://cve.now/CVE-2026-118450.md): Venere loads replaceable unsigned components from a writable installation location (CVSS 5.9, CompuGroup Medical Venere)
- [CVE-2026-112172](https://cve.now/CVE-2026-112172.md): Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure (CVSS 8.1, CompuGroup Medical XDent · CompuGroup Medical XMedical)
- [CVE-2026-121629](https://cve.now/CVE-2026-121629.md): Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-124684](https://cve.now/CVE-2026-124684.md): Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. (CVSS 5.1, Samsung Open Source Escargot)
- [CVE-2026-124621](https://cve.now/CVE-2026-124621.md): kongxin-github Java\_Library\_Management\_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization (CVSS 5.3, kongxin-github Java\_Library\_Management\_System)
- [CVE-2026-123460](https://cve.now/CVE-2026-123460.md): WordPress WordPress File Upload plugin \<= 5.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nickboss WordPress File Upload)
- [CVE-2026-122661](https://cve.now/CVE-2026-122661.md): WordPress Directorist plugin \<= 8.10.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpWax Directorist)
- [CVE-2026-121722](https://cve.now/CVE-2026-121722.md): WordPress Formidable Forms Signature Online Contract Automation plugin \<= 2.0.5 - Broken Access Control vulnerability (CVSS 7.5, WP E-Signature Formidable Forms Signature Online Contract A…)
- [CVE-2026-119515](https://cve.now/CVE-2026-119515.md): WordPress Radius Booking — Booking Calendar for Appointments & Services plugin \<= 1.0.20 - Broken Access Control vulnerability (CVSS 6.5, Mamunur Rashid Radius Booking — Booking Calendar for Appoin…)
- [CVE-2026-122665](https://cve.now/CVE-2026-122665.md): WordPress Mang Board WP plugin \<= 2.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kitae Park Mang Board WP)
- [CVE-2026-122666](https://cve.now/CVE-2026-122666.md): WordPress Mang Board WP plugin \<= 2.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kitae Park Mang Board WP)
- [CVE-2026-119524](https://cve.now/CVE-2026-119524.md): WordPress WP Customer Area plugin \<= 8.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aguila Technologies WP Customer Area)
- [CVE-2026-123476](https://cve.now/CVE-2026-123476.md): WordPress Featured Image from URL plugin \<= 6.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, fifu.app Featured Image from URL)
- [CVE-2026-120855](https://cve.now/CVE-2026-120855.md): WordPress TI WooCommerce Wishlist plugin \<= 2.14.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, TemplateInvaders TI WooCommerce Wishlist)
- [CVE-2026-121570](https://cve.now/CVE-2026-121570.md): WordPress RSVP and Event Management plugin \<= 2.7.17 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Chill RSVP and Event Management)
- [CVE-2026-123475](https://cve.now/CVE-2026-123475.md): WordPress MapSVG plugin \<= 8.16.3 - Broken Access Control vulnerability (CVSS 7.5, PT Norther Lights Production MapSVG)
- [CVE-2026-121782](https://cve.now/CVE-2026-121782.md): WordPress If-So Dynamic Content Personalization plugin \<= 1.10.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, If-So Dynamic Content Personalization)
- [CVE-2026-120838](https://cve.now/CVE-2026-120838.md): WordPress All-in-One Video Gallery plugin \<= 5.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Plugins360 Labs All-in-One Video Gallery)
- [CVE-2026-113702](https://cve.now/CVE-2026-113702.md): iomad PDF Certificate lib.php local\_iomad\_pluginfile authorization (CVSS 5.3, iomad)
- [CVE-2026-120367](https://cve.now/CVE-2026-120367.md): Apache Axis2/Java: unbounded JSON request body buffering (CVSS 7.5, Apache Software Foundation org.apache.axis2:axis2-json)
- [CVE-2026-124591](https://cve.now/CVE-2026-124591.md): Bahleel CsvExporter.php fputcsv csv injection (CVSS 5.1, Bahleel)
- [CVE-2026-123779](https://cve.now/CVE-2026-123779.md): Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes (low (no CVSS), Apache Software Foundation org.apache.axis2:axis2-transport…)
- [CVE-2026-123753](https://cve.now/CVE-2026-123753.md): Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints (no CVSS, Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-123766](https://cve.now/CVE-2026-123766.md): Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page (no CVSS, Apache Software Foundation org.apache.axis2:axis2-openapi)
- [CVE-2026-123770](https://cve.now/CVE-2026-123770.md): Apache Axis2/Java: Unbounded multipart and form-encoded request bodies (low (no CVSS), Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-106008](https://cve.now/CVE-2026-106008.md): FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc\_sms\_action\_verified (CVSS 5.3, FraudLabs Pro SMS Verification)
- [CVE-2026-115252](https://cve.now/CVE-2026-115252.md): Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option (CVSS 10.0, Confection WordPress Cable)
- [CVE-2026-106466](https://cve.now/CVE-2026-106466.md): JWT Auth \<= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocation (CVSS 7.5, JWT Auth)
- [CVE-2026-120761](https://cve.now/CVE-2026-120761.md): Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents (no CVSS, Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-120832](https://cve.now/CVE-2026-120832.md): Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution (no CVSS, Apache Software Foundation org.apache.axis2:axis2-kernel)
- [CVE-2026-118196](https://cve.now/CVE-2026-118196.md): Apache Allura: OAuth1 rebinding (critical (no CVSS), Apache Software Foundation Apache Allura)
- [CVE-2026-124590](https://cve.now/CVE-2026-124590.md): zhangbw409 library\_manager\_system UserController.java BookController.addBook improper authorization (CVSS 6.9, zhangbw409 library\_manager\_system)
- [CVE-2026-82436](https://cve.now/CVE-2026-82436.md): Apache Storm Client: Deserialization of Untrusted Data from the State Store (no CVSS, Apache Software Foundation org.apache.storm:storm-client)
- [CVE-2026-82440](https://cve.now/CVE-2026-82440.md): Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist (no CVSS, Apache Software Foundation org.apache.storm:storm-client)
- [CVE-2026-124589](https://cve.now/CVE-2026-124589.md): lxtGH OMG-Seg MoE Shard Checkpoint Loader handle\_moe\_load\_and\_save.py load\_state\_dict\_into\_model path traversal (CVSS 5.3, lxtGH OMG-Seg)
- [CVE-2026-119483](https://cve.now/CVE-2026-119483.md): WordPress Form Maker by 10Web plugin \<= 1.15.50 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Form Maker by 10Web)
- [CVE-2026-119497](https://cve.now/CVE-2026-119497.md): WordPress Directorist plugin \<= 8.10.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpWax Directorist)
- [CVE-2026-119505](https://cve.now/CVE-2026-119505.md): WordPress Welcart e-Commerce plugin \<= 2.12.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Welcart e-Commerce)
- [CVE-2026-123463](https://cve.now/CVE-2026-123463.md): WordPress Checkout Files Upload for WooCommerce plugin \<= 2.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Wham Checkout Files Upload for WooCommerce)
- [CVE-2026-121763](https://cve.now/CVE-2026-121763.md): WordPress Hummingbird plugin \<= 3.21.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPMU DEV Hummingbird)
- [CVE-2026-66675](https://cve.now/CVE-2026-66675.md): WordPress Motors plugin \<= 1.4.128 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, StylemixThemes Motors)
- [CVE-2026-119514](https://cve.now/CVE-2026-119514.md): WordPress RepairBuddy plugin \<= 4.1234 - Privilege Escalation vulnerability (CVSS 6.3, Webful Creations RepairBuddy)
- [CVE-2026-123484](https://cve.now/CVE-2026-123484.md): WordPress JetFormBuilder plugin \<= 3.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetFormBuilder)
- [CVE-2026-121764](https://cve.now/CVE-2026-121764.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FolioVision FV Flowplayer Video Player)
- [CVE-2026-119504](https://cve.now/CVE-2026-119504.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.30.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Frontend Admin by DynamiApps)
- [CVE-2026-119503](https://cve.now/CVE-2026-119503.md): WordPress Welcart e-Commerce plugin \<= 2.12.6 - Content Injection vulnerability (CVSS 6.5, Welcart e-Commerce)
- [CVE-2026-54863](https://cve.now/CVE-2026-54863.md): WordPress Review Schema plugin \<= 3.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mamunur Rashid Review Schema)
- [CVE-2026-123465](https://cve.now/CVE-2026-123465.md): WordPress myCred plugin \<= 4.0.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, myCred)
- [CVE-2026-121780](https://cve.now/CVE-2026-121780.md): WordPress Flying Images plugin \<= 2.4.15 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Gijo Varghese Flying Images)
- [CVE-2026-111403](https://cve.now/CVE-2026-111403.md): WordPress WP Inventory Manager plugin \<= 2.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Inventory Manager)
- [CVE-2026-121760](https://cve.now/CVE-2026-121760.md): WordPress weDocs plugin \<= 2.6.1 - Broken Access Control vulnerability (CVSS 7.5, weDevs weDocs)
- [CVE-2026-40913](https://cve.now/CVE-2026-40913.md): Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement (low (no CVSS), Apache Software Foundation apache-airflow-core)
- [CVE-2026-50204](https://cve.now/CVE-2026-50204.md): Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext (no CVSS, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-68982](https://cve.now/CVE-2026-68982.md): Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation (no CVSS, Apache Software Foundation apache-airflow-core)
- [CVE-2026-76185](https://cve.now/CVE-2026-76185.md): Apache Airflow Task SDK: Task SDK SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode (no CVSS, Apache Software Foundation apache-airflow-task-sdk)
- [CVE-2026-86829](https://cve.now/CVE-2026-86829.md): Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation (no CVSS, Apache Software Foundation apache-airflow-core)
- [CVE-2026-82337](https://cve.now/CVE-2026-82337.md): Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization (no CVSS, Apache Software Foundation apache-airflow-core)
- [CVE-2026-86468](https://cve.now/CVE-2026-86468.md): Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs (low (no CVSS), Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-96285](https://cve.now/CVE-2026-96285.md): Apache Airflow: Scheduler: next\_kwargs deserialized before the dict check, so resume data still invokes constructors (no CVSS, Apache Software Foundation apache-airflow-core)
- [CVE-2026-113508](https://cve.now/CVE-2026-113508.md): Apache Airflow: Logout token revocation fails open; errors silently swallowed (low (no CVSS), Apache Software Foundation apache-airflow-core)
- [CVE-2026-124588](https://cve.now/CVE-2026-124588.md): huggingface finetrainers Model Index model.py resolve\_component\_cls code injection (CVSS 5.3, huggingface finetrainers)
- [CVE-2026-101031](https://cve.now/CVE-2026-101031.md): Apache Airflow: Shell command injection in the example\_dag\_decorator example Dag via an IPv6 zone identifier (low (no CVSS), Apache Software Foundation apache-airflow-core)
- [CVE-2026-92683](https://cve.now/CVE-2026-92683.md): Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql (CVSS 8.6, @neo4j/graphql)
- [CVE-2026-124587](https://cve.now/CVE-2026-124587.md): elizaOS eliza HTTP Server api-base-owner.ts information disclosure (CVSS 5.3, elizaOS eliza)
- [CVE-2026-113504](https://cve.now/CVE-2026-113504.md): Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext (no CVSS, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-107474](https://cve.now/CVE-2026-107474.md): Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext (no CVSS, Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-111395](https://cve.now/CVE-2026-111395.md): Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline… (no CVSS, Apache Software Foundation apache-airflow-core)
- [CVE-2026-124637](https://cve.now/CVE-2026-124637.md): Stored Cross-Site Scripting (XSS) in Tankuam Places (CVSS 5.3, Kompini Tankuam Places)
- [CVE-2026-111421](https://cve.now/CVE-2026-111421.md): Apache Airflow: Execution API: set\_xcom skips the reserved-key check, so task-written XComs instantiate airflow. classes on the API server (CVSS 8.8, Apache Software Foundation apache-airflow-core)
- [CVE-2026-124586](https://cve.now/CVE-2026-124586.md): Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds (CVSS 6.9, Tencent RapidJSON)
- [CVE-2026-111452](https://cve.now/CVE-2026-111452.md): Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list (low (no CVSS), Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-111453](https://cve.now/CVE-2026-111453.md): Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag\_id query value but deletes rows for every readable Dag (CVSS 4.3, Apache Software Foundation apache-airflow-core)
- [CVE-2026-111454](https://cve.now/CVE-2026-111454.md): Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read (low (no CVSS), Apache Software Foundation apache-airflow · Apache Software…)
- [CVE-2026-111455](https://cve.now/CVE-2026-111455.md): Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit (low (no CVSS), Apache Software Foundation apache-airflow-core)
- [CVE-2026-124585](https://cve.now/CVE-2026-124585.md): Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add\_expmac os command injection (CVSS 9.4, Chengdu Feiyuxing Technology VW2100 · Chengdu Feiyuxing Tec…)
- [CVE-2026-123870](https://cve.now/CVE-2026-123870.md): \[Eclipse CSI - otterdog\] Unauthenticated remote code execution via eval() on format-string-injected webhook body when… (CVSS 9.5, Eclipse Foundation otterdog)
- [CVE-2026-116337](https://cve.now/CVE-2026-116337.md): Uncontrolled resource consumption vulnerability in HTTP response handling of Qt Network impacts Qt Framework (CVSS 0.6, Qt Framework)
- [CVE-2026-124584](https://cve.now/CVE-2026-124584.md): wummel patool Gzip Extraction fileutil.py extract\_gzip symlink (CVSS 4.8, wummel patool)
- [CVE-2026-92606](https://cve.now/CVE-2026-92606.md): TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputer (CVSS 6.0, TÜBİTAK BİLGEM Software Technologies Research Institute Par…)
- [CVE-2026-124582](https://cve.now/CVE-2026-124582.md): WebTorrent File Path torrent.js getFileModtimes path traversal (CVSS 5.3, WebTorrent)
- [CVE-2026-94249](https://cve.now/CVE-2026-94249.md): Missing Authorization in TÜBİTAK BİLGEM's Liderahenk (CVSS 8.1, TÜBİTAK BİLGEM Software Technologies Research Institute Lid…)
- [CVE-2026-124581](https://cve.now/CVE-2026-124581.md): itsourcecode Airline Reservation System manage\_flight.php sql injection (CVSS 6.9, itsourcecode Airline Reservation System)
- [CVE-2026-124580](https://cve.now/CVE-2026-124580.md): Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle\_wechat\_cn\_wifi os command injection (CVSS 10.0, Chengdu Feiyuxing Technology VW2100 · Chengdu Feiyuxing Tec…)
- [CVE-2026-113437](https://cve.now/CVE-2026-113437.md): Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. (CVSS 5.3, DOS Co. SS1 · Rococo Co. rocoeyes)
- [CVE-2026-109582](https://cve.now/CVE-2026-109582.md): Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. (CVSS 4.0, DOS Co. SS1)
- [CVE-2026-124579](https://cve.now/CVE-2026-124579.md): aaPanel BillionMail Relay Configuration API relay.go injection (CVSS 5.3, aaPanel BillionMail)
- [CVE-2026-120386](https://cve.now/CVE-2026-120386.md): Effekseer improperly validates "effect" files. (CVSS 4.3, Effekseer)
- [CVE-2026-124578](https://cve.now/CVE-2026-124578.md): Pantum BP5100DW Web omDB.shtml missing authentication (CVSS 6.9, Pantum BP5100DW)
- [CVE-2026-124577](https://cve.now/CVE-2026-124577.md): Intelbras SG 2404 PoE L2+ Web Management EXCU\_SHELL improper authentication (CVSS 9.3, Intelbras SG 2404 PoE L2+)
- [CVE-2026-124576](https://cve.now/CVE-2026-124576.md): BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow (CVSS 6.9, BeikeShop)
- [CVE-2026-124575](https://cve.now/CVE-2026-124575.md): SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication (CVSS 6.3, SiteServer SSCMS)
- [CVE-2026-124574](https://cve.now/CVE-2026-124574.md): chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization (CVSS 5.3, chenyme grok2api)
- [CVE-2026-124573](https://cve.now/CVE-2026-124573.md): logseq Local HTTP API server.cljs validate-auth-token missing authentication (CVSS 6.9, logseq)
- [CVE-2026-124572](https://cve.now/CVE-2026-124572.md): DataLinkDC dinky Catalogue Upload API CatalogueController.java CatalogueController.upload path traversal (CVSS 5.3, DataLinkDC dinky)
- [CVE-2026-81422](https://cve.now/CVE-2026-81422.md): Advanced Appointment Booking & Scheduling \< 2.7 - Unauthenticated Arbitrary User Registration (CVSS 5.3, Advanced Appointment Booking & Scheduling)
- [CVE-2026-123751](https://cve.now/CVE-2026-123751.md): WP Duplicate \<= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass (CVSS 9.8, WP Duplicate)
- [CVE-2026-123145](https://cve.now/CVE-2026-123145.md): WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout (CVSS 4.4, WooCommerce Stripe Payment Gateway)
- [CVE-2026-123131](https://cve.now/CVE-2026-123131.md): GemBooking \< 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass (CVSS 5.9, GemBooking)
- [CVE-2026-123129](https://cve.now/CVE-2026-123129.md): Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation (CVSS 5.3, Event Tickets Manager for WooCommerce)
- [CVE-2026-123128](https://cve.now/CVE-2026-123128.md): GemBooking \< 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition (CVSS 3.7, GemBooking)
- [CVE-2026-123091](https://cve.now/CVE-2026-123091.md): Vigilant \< 2.11.0 - 2FA Bypass via Third-Party Login Forms (CVSS 7.5, Vigilant)
- [CVE-2026-123088](https://cve.now/CVE-2026-123088.md): UniPAY Payment Gateway For WooCommerce \< 2.4 - Unauthenticated Order Key and Customer PII Disclosure (CVSS 5.3, UniPAY Payment Gateway For WooCommerce)
- [CVE-2026-123064](https://cve.now/CVE-2026-123064.md): WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation (CVSS 8.8, WP BASE Booking of Appointments, Services and Events)
- [CVE-2026-121875](https://cve.now/CVE-2026-121875.md): Post Duplicator \< 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment (CVSS 7.2, Post Duplicator)
- [CVE-2026-121874](https://cve.now/CVE-2026-121874.md): Post Duplicator \< 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name (CVSS 7.2, Post Duplicator)
- [CVE-2026-121759](https://cve.now/CVE-2026-121759.md): Fusion Page Builder \< 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR (CVSS 4.9, Fusion Page Builder)
- [CVE-2026-120409](https://cve.now/CVE-2026-120409.md): All-in-One Video Gallery \< 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler (CVSS 5.3, All-in-One Video Gallery)
- [CVE-2026-118202](https://cve.now/CVE-2026-118202.md): Limit Login Attempts Reloaded \< 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header (CVSS 7.5, Limit Login Attempts Security)
- [CVE-2026-118201](https://cve.now/CVE-2026-118201.md): Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC (CVSS 7.5, Limit Login Attempts Security)
- [CVE-2026-115256](https://cve.now/CVE-2026-115256.md): Mail Debug for WooCommerce \<= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover (CVSS 7.5, Mail Debug for WooCommerce)
- [CVE-2026-115237](https://cve.now/CVE-2026-115237.md): Grand Job \<= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code (CVSS 9.8, Grand Job)
- [CVE-2026-115213](https://cve.now/CVE-2026-115213.md): EASY-JS-WPAPI \<= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass (CVSS 9.8, EASY-JS-WPAPI Client HANDLE for the WordPress REST-API)
- [CVE-2026-115212](https://cve.now/CVE-2026-115212.md): mView \<= 1.0.3 - Subscriber+ Arbitrary File Upload (CVSS 8.8, mView 豆瓣电影)
- [CVE-2026-115204](https://cve.now/CVE-2026-115204.md): AZEXO Store Locator \<= 1.4 - Subscriber+ Arbitrary File Write via azt\_items\_import (CVSS 8.8, AZEXO Store Locator)
- [CVE-2026-124571](https://cve.now/CVE-2026-124571.md): SourceCodester Simple CRUD using PHP and FPDF register.php sql injection (CVSS 5.3, SourceCodester Simple CRUD using PHP and FPDF)
- [CVE-2026-124570](https://cve.now/CVE-2026-124570.md): SourceCodester Online Leave Management System Employee Avatar Upload Extension Master.php cross site scripting (CVSS 4.8, SourceCodester Online Leave Management System)
- [CVE-2026-124569](https://cve.now/CVE-2026-124569.md): fushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access control (CVSS 5.3, fushengqian fuintCatering)
- [CVE-2026-124568](https://cve.now/CVE-2026-124568.md): fushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access control (CVSS 5.3, fushengqian fuintCatering)
- [CVE-2026-124567](https://cve.now/CVE-2026-124567.md): fushengqian fuint ClientOrderController.java receipt state issue (CVSS 5.3, fushengqian fuint)
- [CVE-2026-124566](https://cve.now/CVE-2026-124566.md): fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow (CVSS 5.3, fushengqian fuint)
- [CVE-2026-124565](https://cve.now/CVE-2026-124565.md): fushengqian fuint Order Verification MerchantOrderController.java confirm access control (CVSS 5.3, fushengqian fuint)
- [CVE-2026-113364](https://cve.now/CVE-2026-113364.md): Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through… (CVSS 9.3, NEC WebSAM WinShare)
- [CVE-2026-113363](https://cve.now/CVE-2026-113363.md): Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0… (CVSS 9.3, NEC WebSAM WinShare)
- [CVE-2026-113362](https://cve.now/CVE-2026-113362.md): Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3)… (CVSS 8.5, NEC WebSAM WinShare)
- [CVE-2026-124564](https://cve.now/CVE-2026-124564.md): D-Link DIR-878 HNAP prog.cgi GetListDirectory path traversal (CVSS 6.9, D-Link DIR-878)
- [CVE-2026-124563](https://cve.now/CVE-2026-124563.md): D-Link DIR-878 HNAP SetWanSettings buffer overflow (CVSS 8.7, D-Link DIR-878)
- [CVE-2026-124562](https://cve.now/CVE-2026-124562.md): D-Link DIR-878 HNAP SetWanSettings buffer overflow (CVSS 8.7, D-Link DIR-878)
- [CVE-2026-124561](https://cve.now/CVE-2026-124561.md): D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow (CVSS 8.7, D-Link DIR-878)
- [CVE-2026-124560](https://cve.now/CVE-2026-124560.md): D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow (CVSS 9.3, D-Link DIR-878)
- [CVE-2026-121825](https://cve.now/CVE-2026-121825.md): Open redirect in the Liberty ID-FF service provider single sign-on flow (CVSS 5.1, OpenAM)
- [CVE-2026-124558](https://cve.now/CVE-2026-124558.md): DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery (CVSS 6.9, DataLinkDC Dinky)
- [CVE-2026-124557](https://cve.now/CVE-2026-124557.md): OtterMind Chat2DB Class Generator DbMybatisGenerateServiceImpl.java DbMybatisGenerateServiceImpl.generateClass path traversal (CVSS 6.9, OtterMind Chat2DB)
- [CVE-2026-124556](https://cve.now/CVE-2026-124556.md): kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect (CVSS 5.3, kekingcn kkFileView)
- [CVE-2026-124555](https://cve.now/CVE-2026-124555.md): JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection (CVSS 5.3, JeecgBoot)
- [CVE-2026-124554](https://cve.now/CVE-2026-124554.md): JeecgBoot JimuBI getAllChartData sql injection (CVSS 6.9, JeecgBoot)
- [CVE-2026-124509](https://cve.now/CVE-2026-124509.md): floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal (CVSS 6.9, floci-io Floci)
- [CVE-2026-124508](https://cve.now/CVE-2026-124508.md): floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal (CVSS 6.9, floci-io Floci)
- [CVE-2026-124507](https://cve.now/CVE-2026-124507.md): conductor-oss conductor PLANNER\_CONTEXT\_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery (CVSS 6.9, conductor-oss conductor)
- [CVE-2026-124506](https://cve.now/CVE-2026-124506.md): Dianping CAT Report hourlyReport.tag Model.getDomain cross site scripting (CVSS 5.3, Dianping CAT)
- [CVE-2026-119506](https://cve.now/CVE-2026-119506.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.30.1 - Privilege Escalation vulnerability (CVSS 9.1, Frontend Admin by DynamiApps)
- [CVE-2026-124505](https://cve.now/CVE-2026-124505.md): Dianping CAT Login/Logout Handler.java Handler.redirect (CVSS 5.3, Dianping CAT)
- [CVE-2026-124504](https://cve.now/CVE-2026-124504.md): erupts erupt ReportService.java ReportService.queryBiData sql injection (CVSS 5.3, erupts erupt)
- [CVE-2026-124502](https://cve.now/CVE-2026-124502.md): yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization (CVSS 5.3, yungifez Skuul School Management System)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/daily/2026-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.