2026 CVEs (page 101)
Page 101 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23787 | Medium | 4.2 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM… |
CVE-2026-23786 | Low | 2.8 | 2026-09-14 | An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A TOCTOU race condition in the Exyn… |
CVE-2026-90606 | Critical | 9.9 | 2026-09-14 | A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Set… |
CVE-2026-90605 | Critical | 9.9 | 2026-09-14 | A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the… |
CVE-2026-90604 | Low | 3.5 | 2026-09-14 | A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manip… |
CVE-2026-90603 | High | 7.3 | 2026-09-13 | A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/uplo… |
CVE-2026-90602 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file I… |
CVE-2026-90601 | High | 7.3 | 2026-09-13 | A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API… |
CVE-2026-90600 | Medium | 6.3 | 2026-09-13 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulat… |
CVE-2026-15892 | Medium | 5.3 | 2026-09-13 | The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mg… |
CVE-2026-15891 | High | 7.5 | 2026-09-13 | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invo… |
CVE-2026-90599 | Medium | 4.3 | 2026-09-13 | A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file incl… |
CVE-2026-90598 | Medium | 6.3 | 2026-09-13 | A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function… |
CVE-2026-90597 | Medium | 6.3 | 2026-09-13 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_e… |
CVE-2026-90596 | Medium | 6.5 | 2026-09-13 | A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw… |
CVE-2026-52297 | Low | 2.9 | 2026-09-13 | FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c. |
CVE-2026-52296 | Low | 2.9 | 2026-09-13 | FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c. |
CVE-2026-35867 | Low | 3.1 | 2026-09-13 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell m… |
CVE-2026-90595 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file ac… |
CVE-2026-90594 | Medium | 6.3 | 2026-09-13 | A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of t… |
CVE-2026-90593 | High | 7.3 | 2026-09-13 | A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executi… |
CVE-2026-90584 | Medium | 5.3 | 2026-09-13 | A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draf… |
CVE-2026-89050 | Medium | 4.3 | 2026-09-13 | The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an… |
CVE-2026-88802 | High | 7.5 | 2026-09-13 | The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or… |
CVE-2026-88793 | High | 8.8 | 2026-09-13 | The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on… |
CVE-2026-85129 | High | 8.8 | 2026-09-13 | The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data sub… |
CVE-2026-81648 | Critical | 10.0 | 2026-09-13 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated use… |
CVE-2026-74933 | High | 8.8 | 2026-09-13 | The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values be… |
CVE-2026-38332 | Low | 2.9 | 2026-09-13 | TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. |
CVE-2026-37008 | High | 8.1 | 2026-09-13 | CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-… |
CVE-2026-36989 | Medium | 5.8 | 2026-09-13 | A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php. |
CVE-2026-36453 | High | 7.4 | 2026-09-13 | Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables. |
CVE-2026-90583 | Medium | 4.3 | 2026-09-13 | A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the fi… |
CVE-2026-90582 | Medium | 5.3 | 2026-09-13 | A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo E… |
CVE-2026-90581 | Medium | 6.3 | 2026-09-13 | A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpd… |
CVE-2026-90580 | Medium | 6.3 | 2026-09-13 | A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/eval… |
CVE-2026-29812 | Medium | 4.3 | 2026-09-13 | CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. |
CVE-2026-29811 | High | 7.7 | 2026-09-13 | CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias")… |
CVE-2026-29810 | Medium | 4.3 | 2026-09-13 | CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. |
CVE-2026-90579 | High | 7.3 | 2026-09-13 | A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custo… |
CVE-2026-90578 | Medium | 5.3 | 2026-09-13 | A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/list.c of the component MP4Box. Executing… |
CVE-2026-90577 | Medium | 5.3 | 2026-09-13 | A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c… |
CVE-2026-90576 | Low | 3.3 | 2026-09-13 | A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of… |
CVE-2026-90575 | Low | 3.7 | 2026-09-13 | A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Han… |
CVE-2026-90574 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emp_transac.php?action=… |
CVE-2026-90573 | Low | 3.3 | 2026-09-13 | A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the componen… |
CVE-2026-90572 | Medium | 4.7 | 2026-09-13 | A vulnerability was determined in davenardella snap7 up to 1.4.3. The affected element is the function TSnap7MicroClient::opUpload of the file src/core/s7_micr… |
CVE-2026-90571 | Medium | 4.3 | 2026-09-13 | A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/mai… |
CVE-2026-90570 | Low | 2.4 | 2026-09-13 | A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file lit… |
CVE-2026-90569 | Low | 2.4 | 2026-09-13 | A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemal… |
CVE-2026-90568 | Low | 3.5 | 2026-09-13 | A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resourc… |
CVE-2026-90567 | Low | 3.5 | 2026-09-13 | A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/s… |
CVE-2026-90566 | High | 7.3 | 2026-09-13 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the fu… |
CVE-2026-90565 | Medium | 5.3 | 2026-09-13 | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of… |
CVE-2026-90564 | Low | 3.5 | 2026-09-13 | A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/c… |
CVE-2026-90563 | Low | 3.5 | 2026-09-13 | A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipula… |
CVE-2026-90529 | Low | 3.5 | 2026-09-13 | A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/… |
CVE-2026-90528 | Low | 3.5 | 2026-09-13 | A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/w… |
CVE-2026-90527 | Medium | 4.3 | 2026-09-13 | A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue o… |
CVE-2026-90526 | High | 7.3 | 2026-09-13 | A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_c… |
CVE-2026-90525 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executin… |
CVE-2026-90524 | High | 7.3 | 2026-09-13 | A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unkn… |
CVE-2026-90523 | High | 7.3 | 2026-09-13 | A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown f… |
CVE-2026-90783 | High | 7.8 | 2026-09-13 | MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic… |
CVE-2026-90782 | Medium | 5.3 | 2026-09-13 | S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataCh… |
CVE-2026-90781 | Medium | 4.4 | 2026-09-13 | alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when pars… |
CVE-2026-90522 | High | 7.3 | 2026-09-13 | A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass o… |
CVE-2026-90521 | Medium | 6.3 | 2026-09-13 | A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processin… |
CVE-2026-90520 | Medium | 6.3 | 2026-09-13 | A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown c… |
CVE-2026-90519 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. T… |
CVE-2026-90780 | High | 7.5 | 2026-09-13 | SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content… |
CVE-2026-90779 | High | 7.5 | 2026-09-13 | SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm… |
CVE-2026-90778 | High | 7.5 | 2026-09-13 | SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more… |
CVE-2026-90777 | High | 8.8 | 2026-09-13 | ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-suppli… |
CVE-2026-90776 | High | 7.5 | 2026-09-13 | Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC… |
CVE-2026-90775 | Medium | 6.5 | 2026-09-13 | PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attacker… |
CVE-2026-90518 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation… |
CVE-2026-90517 | Medium | 5.3 | 2026-09-13 | A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The… |
CVE-2026-90516 | High | 7.3 | 2026-09-13 | A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_r… |
CVE-2026-90515 | High | 7.3 | 2026-09-13 | A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/… |
CVE-2026-90774 | High | 7.5 | 2026-09-13 | rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape… |
CVE-2026-90773 | Low | 3.2 | 2026-09-13 | procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute pro… |
CVE-2026-90772 | High | 7.6 | 2026-09-13 | Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem c… |
CVE-2026-90771 | Low | 3.7 | 2026-09-13 | joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error cod… |
CVE-2026-90770 | High | 8.8 | 2026-09-13 | Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into sh… |
CVE-2026-90769 | High | 7.7 | 2026-09-13 | Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to… |
CVE-2026-90768 | High | 8.1 | 2026-09-13 | CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by oth… |
CVE-2026-90767 | Medium | 6.5 | 2026-09-13 | Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into a… |
CVE-2026-90562 | High | 8.1 | 2026-09-13 | LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoin… |
CVE-2026-90561 | High | 8.7 | 2026-09-13 | Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component t… |
CVE-2026-90514 | High | 7.3 | 2026-09-13 | A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.ph… |
CVE-2026-90513 | Medium | 6.5 | 2026-09-13 | A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of t… |
CVE-2026-90511 | Medium | 6.3 | 2026-09-13 | A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file sr… |
CVE-2026-90510 | High | 8.3 | 2026-09-13 | A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-… |
CVE-2026-90509 | High | 7.3 | 2026-09-13 | A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApi… |
CVE-2026-90508 | Low | 3.4 | 2026-09-13 | A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in… |
CVE-2026-90507 | Medium | 6.3 | 2026-09-13 | A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge_subscription of th… |
CVE-2026-90506 | Medium | 5.0 | 2026-09-13 | A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Sav… |
CVE-2026-90505 | Medium | 5.0 | 2026-09-13 | A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipula… |
CVE-2026-90504 | High | 7.3 | 2026-09-13 | A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The… |