What needs attention now.

CVE-2026-104056

• Authlib
• CWE-345
• CWE-346

DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

• dhis2-core
• Insecure deserialization

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

• Broken access control

>=0.0.0-20260726161145-9b8e8956f997, <0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2

Foreman: excessive permissions for viewer role on preview

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Privilege escalation

Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

• Apache Software Foundation Apache HTTP Server
• Privilege escalation

WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access

• WatchGuard Endpoint Security
• Authentication bypass
• Hard-coded credentials

Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

• Apache Software Foundation Apache HTTP Server
• Memory corruption

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

• Apache Software Foundation Apache HTTP Server
• Memory corruption

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

• CWE-693

>=3.9.6, <3.11.7 · fixed in 3.11.7

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

• CWE-453
• CWE-829

<3.11.7 · fixed in 3.11.7

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

• Information disclosure

>=3.11.3, <3.11.7 · fixed in 3.11.7

Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

• foundation50 classroom50
• Path traversal

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

• Broken access control
• CWE-706

<3.11.7 · fixed in 3.11.7

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

• Privilege escalation
• Broken access control

<3.11.7 · fixed in 3.11.7

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

• CWE-913

>=3.11.4, <3.11.7 · fixed in 3.11.7

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

• Code injection
• CWE-693

>=3.11.6, <3.11.7 · fixed in 3.11.7

Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability

• Fortra's Core Privileged Access Manager (BoKS)
• Memory corruption

vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

• CWE-693

>=3.11.3, <3.11.7 · fixed in 3.11.7

vm2 crypto builtin loads attacker native code through setEngine

• CWE-114

>=3.11.3, <3.11.7 · fixed in 3.11.7

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

• CWE-693
• CWE-913

>=3.10.2, <3.11.7 · fixed in 3.11.7

vm2 NodeVM can replace the host process TLS trust store

• Broken access control

>=3.11.3, <3.11.7 · fixed in 3.11.7

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

• Prototype pollution

<4.9.4 || >=5.0.0, <5.3.2 || >=6.0.0-rc.1, <6.0.0-rc.5 · fixed in 4.9.4, 5.3.2, 6.0.0-rc.5

Fortra BoKS Manager crlserver command injection vulnerability

• Fortra BoKS Manager
• Command injection

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

• SQL injection

<0.0.0-20260721043339-eef10568384e · fixed in 0.0.0-20260721043339-eef10568384e

WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

• nickboss WordPress File Upload
• SQL injection

WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability

• Paul Ryan Authorizer
• Privilege escalation

Predictable Active Directory service-account passwords in BoKS Manager

• Fortra BoKS Manager boks-server
• Weak cryptography or TLS

Fleet before 4.87.0 Authentication Bypass via Device Identifiers

• fleet
• Authentication bypass

ground-station before 0.8.0 Authentication Bypass via setup.restore

• sgoudelis ground-station
• Authentication bypass

MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

• MISP
• Authentication bypass

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

• WebRehab Super Forms – Drag & Drop Form Builder
• Privilege escalation

Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter

• superdav42 Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
• Authentication bypass

Path traversal in dynamically created BACnet File Objects

• WAGO 0751-9x01
• WAGO 0750-811x-xxxx-xxxx
• Path traversal

BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

• BackupSheep WordPress Backup Plugin
• Path traversal

Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

• Hitachi Industrial Equipment Systems Hitachi Coding Software Suite
• Path traversal

Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

• Hitachi Industrial Equipment Systems Hitachi Coding Software Suite
• Authentication bypass

A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

• Hitachi Industrial Equipment Systems Hitachi Coding Software Suite
• Hard-coded credentials

Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process

• Hitachi Industrial Equipment Systems Hitachi Coding Software Suite
• CWE-912

Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

• Genians, Inc Genian NAC 5.0.75 LTS Release
• Genians, Inc Genian NAC 5.0.85 Release Stable
• Broken access control
• Authentication bypass

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
• Code injection

Uncontrolled format string in ASUS Router

• ASUS Router
• Memory corruption

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).

• Broken access control

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap.

• Broken access control

The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal.

• Path traversal

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal.

• Path traversal

The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal.

• Path traversal

deeptutor 1.4.0 contains code injection in ExecTool.execute.

• Code injection

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute.

• Path traversal

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file.

• Broken access control

DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow.

• Broken access control

In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compro…

• Path traversal

Heap-based buffer overflow in esnet iperf3

• esnet iperf3
• Memory corruption

Use after free in esnet iperf3

• esnet iperf3
• Memory corruption

Meta Platforms, Inc Meta Horizon OS: Prior to v74.0.0.878.1682 of Meta Horizon OS…

• Meta Platforms, Inc Meta Horizon OS
• CWE-923

Kiteworks Email Protection Gateway server-side request forgery

• Kiteworks Email Protection Gateway
• Server-side request forgery (SSRF)

Kiteworks Email Protection Gateway improper authentication

• Kiteworks Email Protection Gateway
• Authentication bypass

Kiteworks Core Authentication Bypass in the Password Reset Workflow

• Kiteworks Core
• CWE-640

Kiteworks Email Protection Gateway server-side request forgery

• Kiteworks Email Protection Gateway
• Server-side request forgery (SSRF)

Kiteworks Email Protection Gateway server-side request forgery

• Kiteworks Email Protection Gateway
• Server-side request forgery (SSRF)

Kiteworks Email Protection Gateway server-side request forgery

• Kiteworks Email Protection Gateway
• Server-side request forgery (SSRF)