2026 CVEs (page 103)
Page 103 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82845 | Critical | 9.9 | 2026-09-12 | The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowi… |
CVE-2026-81742 | High | 8.8 | 2026-09-12 | The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted… |
CVE-2026-81429 | High | 7.1 | 2026-09-12 | The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise t… |
CVE-2026-81402 | Critical | 9.8 | 2026-09-12 | The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler… |
CVE-2026-81090 | High | 7.2 | 2026-09-12 | The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing at… |
CVE-2026-80494 | High | 8.6 | 2026-09-12 | The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint tha… |
CVE-2026-80491 | High | 8.6 | 2026-09-12 | The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated action… |
CVE-2026-78152 | Medium | 5.3 | 2026-09-12 | The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages… |
CVE-2026-77753 | Medium | 5.5 | 2026-09-12 | The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke… |
CVE-2026-77752 | High | 7.2 | 2026-09-12 | The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights… |
CVE-2026-77705 | High | 7.2 | 2026-09-12 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitle… |
CVE-2026-77689 | Medium | 5.3 | 2026-09-12 | The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as… |
CVE-2026-77006 | Critical | 9.6 | 2026-09-12 | The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, a… |
CVE-2026-77005 | Critical | 9.6 | 2026-09-12 | The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capabilit… |
CVE-2026-75800 | Critical | 9.8 | 2026-09-12 | The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, al… |
CVE-2026-87719 | Critical | 9.9 | 2026-09-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 1… |
CVE-2026-85706 | Critical | 10.0 | 2026-09-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, an… |
CVE-2026-90467 | Medium | 4.0 | 2026-09-12 | aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT T… |
CVE-2026-89268 | Medium | 5.4 | 2026-09-12 | QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attac… |
CVE-2026-89267 | Medium | 4.3 | 2026-09-12 | starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users t… |
CVE-2026-89266 | High | 8.2 | 2026-09-12 | stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. At… |
CVE-2026-90461 | Medium | 6.3 | 2026-09-11 | OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. |
CVE-2026-90460 | | 2026-09-11 | An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OA… | |
CVE-2026-90457 | Medium | 6.2 | 2026-09-11 | The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file contain… |
CVE-2026-90456 | High | 8.1 | 2026-09-11 | An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment… |
CVE-2026-90455 | Low | 3.7 | 2026-09-11 | A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerab… |
CVE-2026-90454 | Medium | 4.3 | 2026-09-11 | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but… |
CVE-2026-90453 | Low | 3.5 | 2026-09-11 | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it again… |
CVE-2026-90452 | Medium | 5.3 | 2026-09-11 | Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provide… |
CVE-2026-90451 | Medium | 5.9 | 2026-09-11 | An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis com… |
CVE-2026-90450 | Medium | 4.3 | 2026-09-11 | The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather… |
CVE-2026-90449 | Medium | 6.5 | 2026-09-11 | When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that in… |
CVE-2026-90448 | Medium | 6.5 | 2026-09-11 | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which reques… |
CVE-2026-90447 | Medium | 6.5 | 2026-09-11 | A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header… |
CVE-2026-90446 | Medium | 4.3 | 2026-09-11 | An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying s… |
CVE-2026-90445 | Medium | 6.5 | 2026-09-11 | An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain… |
CVE-2026-90444 | High | 8.8 | 2026-09-11 | A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process… |
CVE-2026-90443 | Medium | 5.4 | 2026-09-11 | A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentic… |
CVE-2026-54258 | Medium | 6.5 | 2026-09-11 | ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-pri… |
CVE-2026-54248 | Medium | 6.5 | 2026-09-11 | Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1… |
CVE-2026-54241 | High | 7.4 | 2026-09-11 | libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offse… |
CVE-2026-54240 | High | 7.4 | 2026-09-11 | libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a… |
CVE-2026-50018 | Medium | 6.5 | 2026-09-11 | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration… |
CVE-2026-50013 | High | 7.5 | 2026-09-11 | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `… |
CVE-2026-49992 | | 2026-09-11 | Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creat… | |
CVE-2026-49846 | High | 7.5 | 2026-09-11 | libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose… |
CVE-2026-48496 | Medium | 6.2 | 2026-09-11 | OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and pr… |
CVE-2026-45056 | | 2026-09-11 | matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and pr… | |
CVE-2026-44715 | | 2026-09-11 | OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR… | |
CVE-2026-81918 | Medium | 4.8 | 2026-09-11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions… |
CVE-2026-81917 | Medium | 5.4 | 2026-09-11 | Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with… |
CVE-2026-81907 | High | 7.1 | 2026-09-11 | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/expre… |
CVE-2026-68535 | Medium | 4.3 | 2026-09-11 | Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which… |
CVE-2026-54174 | High | 8.3 | 2026-09-11 | melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified… |
CVE-2026-54166 | High | 7.1 | 2026-09-11 | Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP… |
CVE-2026-54165 | | 2026-09-11 | Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting (XS… | |
CVE-2026-50025 | | 2026-09-11 | Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management bound… | |
CVE-2026-49865 | | 2026-09-11 | Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview an… | |
CVE-2026-49464 | High | 8.1 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-49439 | Medium | 4.3 | 2026-09-11 | OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets`… |
CVE-2026-48490 | | 2026-09-11 | ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attac… | |
CVE-2026-47773 | | 2026-09-11 | ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write r… | |
CVE-2026-45057 | Medium | 4.9 | 2026-09-11 | matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is miss… |
CVE-2026-89773 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not ha… | |
CVE-2026-89772 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb ("btrfs: unify foli… | |
CVE-2026-89771 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is… |
CVE-2026-89770 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not a… | |
CVE-2026-89769 | High | 7.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path When cpuhp_setu… |
CVE-2026-89768 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stor… | |
CVE-2026-89767 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases t… |
CVE-2026-89766 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec_update_lock around namespace ioctl The PIDFD_GET_*_NAMESPACE ioctls in p… | |
CVE-2026-89765 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct… | |
CVE-2026-89764 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition wh… |
CVE-2026-89763 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference… |
CVE-2026-89762 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_curr… |
CVE-2026-89761 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null… |
CVE-2026-89760 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in… |
CVE-2026-89759 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid… | |
CVE-2026-89758 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-… |
CVE-2026-89757 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort_folio() has a shortcut… | |
CVE-2026-89756 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batc… | |
CVE-2026-89755 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() r… |
CVE-2026-89754 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk-… |
CVE-2026-89753 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() I am seeing some rcu_task… | |
CVE-2026-89752 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is superseded kernfs serializes file operatio… | |
CVE-2026-89751 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handle_in() and handle_out() in arch/x86/coc… | |
CVE-2026-89750 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct()… |
CVE-2026-89749 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run… | |
CVE-2026-89748 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_r… |
CVE-2026-89747 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buff… |
CVE-2026-89746 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on diffe… |
CVE-2026-89745 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmap_prepare Commit 651fdda8406d ("relay: update relay to… | |
CVE-2026-89744 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over chil… |
CVE-2026-89743 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the… |
CVE-2026-89742 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mut… |
CVE-2026-89741 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in __video_register_device()" This reverts co… |
CVE-2026-89740 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: serial: imx: serialize imx_uart_ports[] lifetime imx_uart_probe() publishes its devm-allo… | |
CVE-2026-89739 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition … | |
CVE-2026-89738 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mo… |
CVE-2026-89737 | | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: thunderbolt: Disable work before freeing tbt on remove tbt_altmode_remove() d… |