📋 ADVISORIES
📄 Source for Critical Capacitor WebView navigation bypass (CVE-2026-103922, CVSS 9.3) enables same-origin compromise — github.com
📄 Source for CISA adds actively exploited FortiMail path traversal flaw CVE-2026-104286 to KEV catalog — fortiguard.fortinet.com
🔓 CVEs & KEV
CVE-2026-55083 — dhis2 dhis2-core — CVSS 9.1 — DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)DHIS2 is a fl...
CVE-2026-104018 — Wind River Systems Inc VxWorks 7 — CVSS 8.8 — VxWorks 7 improper privilege managementAn improper privilege management vulne...
CVE-2026-102369 — TP-Link Systems Inc. Tapo C200 v5 — CVSS 8.7 — Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Lin...
CVE-2026-84682 — TP-Link Systems Inc. Archer AX90 v1 — CVSS 7.7 — TDDPv2 setProductVer Command Injection in Archer AX90A command injection vuln...
CVE-2026-8618 — TP-Link Systems Inc. Deco M9 Plus V2 — CVSS 7.7 — Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv...
CVE-2026-78578 — TP-Link Systems Inc. Tapo C200 v5 — CVSS 7.1 — Unauthenticated do Method Onboarding Connect Allows Wi‐Fi Reconfiguration Den...
CVE-2026-9032 — TP-Link Systems Inc. Tapo C200 V5 — CVSS 7.1 — Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service...