2026 CVEs (page 110)
Page 110 of 452 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45295 | Medium | 6.5 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conv… |
CVE-2026-44228 | Medium | 5.4 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS)… |
CVE-2026-44227 | Medium | 6.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS… |
CVE-2026-39878 | Critical | 9.3 | 2026-07-20 | Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated atta… |
CVE-2026-34239 | | 2026-07-20 | Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected o… | |
CVE-2026-26483 | Medium | 6.1 | 2026-07-20 | Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails… |
CVE-2026-64207 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segme… |
CVE-2026-64206 | High | 8.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes… |
CVE-2026-64205 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subs… |
CVE-2026-64192 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized When CONFIG_B… |
CVE-2026-64191 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA ca… |
CVE-2026-64190 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in team_xmit during mode change __team_change_mod… |
CVE-2026-64189 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set… |
CVE-2026-64188 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() remo… |
CVE-2026-64187 | Medium | 5.5 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transacti… |
CVE-2026-58484 | High | 7.1 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` a… |
CVE-2026-58482 | Medium | 5.9 | 2026-07-20 | Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is… |
CVE-2026-58481 | Medium | 6.5 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `ba… |
CVE-2026-58414 | Medium | 5.5 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectB… |
CVE-2026-58413 | Medium | 6.1 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with… |
CVE-2026-55645 | Medium | 6.5 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connectio… |
CVE-2026-55238 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capa… |
CVE-2026-54538 | High | 7.5 | 2026-07-20 | xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field w… |
CVE-2026-54051 | Critical | 9.9 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy… |
CVE-2026-50743 | Medium | 5.4 | 2026-07-20 | A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered v… |
CVE-2026-47276 | Medium | 6.5 | 2026-07-20 | In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sendi… |
CVE-2026-47275 | Low | 2.6 | 2026-07-20 | In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to crash any connecting… |
CVE-2026-46701 | High | 7.6 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_M… |
CVE-2026-46555 | High | 7.7 | 2026-07-20 | WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `wha… |
CVE-2026-44978 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulne… |
CVE-2026-44178 | High | 8.8 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism… |
CVE-2026-42218 | Medium | 5.3 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in respon… |
CVE-2026-42210 | | 2026-07-20 | Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor… | |
CVE-2026-41521 | High | 8.2 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-an… |
CVE-2026-41252 | Critical | 9.8 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating i… |
CVE-2026-40187 | | 2026-07-20 | In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML… | |
CVE-2026-39879 | High | 7.1 | 2026-07-20 | Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql… |
CVE-2026-39385 | | 2026-07-20 | Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated b… | |
CVE-2026-35591 | | 2026-07-20 | libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly de… | |
CVE-2026-35590 | | 2026-07-20 | libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the ra… | |
CVE-2026-35217 | Medium | 6.5 | 2026-07-20 | NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field… |
CVE-2026-35048 | Critical | 9.8 | 2026-07-20 | The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file w… |
CVE-2026-33328 | | 2026-07-20 | libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could inco… | |
CVE-2026-33327 | | 2026-07-20 | libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine… | |
CVE-2026-32825 | High | 7.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32824 | High | 7.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32823 | Medium | 4.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32821 | High | 8.1 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32820 | High | 7.5 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32819 | Medium | 4.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32806 | High | 7.5 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-6793 | Medium | 5.4 | 2026-07-20 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allow… |
CVE-2026-63429 | High | 8.6 | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validatio… |
CVE-2026-63428 | Medium | 5.8 | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitte… |
CVE-2026-63102 | Medium | 5.4 | 2026-07-20 | rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting… |
CVE-2026-51027 | Critical | 9.9 | 2026-07-20 | An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component. |
CVE-2026-51026 | Medium | 6.5 | 2026-07-20 | Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request. |
CVE-2026-48824 | Medium | 5.3 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB… |
CVE-2026-46671 | Medium | 4.4 | 2026-07-20 | Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted `.onetoc2` table-of-content… |
CVE-2026-46428 | | 2026-07-20 | lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration si… | |
CVE-2026-46415 | High | 8.2 | 2026-07-20 | The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1… |
CVE-2026-46412 | Critical | 10.0 | 2026-07-20 | @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:5… |
CVE-2026-45797 | | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Upload… | |
CVE-2026-45713 | High | 7.5 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maxi… |
CVE-2026-45712 | Medium | 5.9 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets m… |
CVE-2026-45711 | Medium | 5.9 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every mess… |
CVE-2026-45709 | Medium | 5.8 | 2026-07-20 | Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check AP… |
CVE-2026-35198 | Critical | 9.0 | 2026-07-20 | HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privile… |
CVE-2026-32822 | Medium | 6.1 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32807 | High | 7.5 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-28220 | High | 8.4 | 2026-07-20 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (D… |
CVE-2026-27823 | | 2026-07-20 | A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary… | |
CVE-2026-26199 | Medium | 6.5 | 2026-07-20 | HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for… |
CVE-2026-26197 | High | 7.5 | 2026-07-20 | HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's si… |
CVE-2026-26081 | Medium | 4.8 | 2026-07-20 | HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. |
CVE-2026-26080 | Low | 3.7 | 2026-07-20 | HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affect… |
CVE-2026-25039 | High | 8.8 | 2026-07-20 | Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vuln… |
CVE-2026-21824 | High | 8.8 | 2026-07-20 | HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorize… |
CVE-2026-13724 | Medium | 4.3 | 2026-07-20 | Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Man… |
CVE-2026-63091 | Medium | 6.5 | 2026-07-20 | ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated… |
CVE-2026-63090 | High | 8.8 | 2026-07-20 | ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attacker… |
CVE-2026-63071 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malic… |
CVE-2026-62418 | High | 8.1 | 2026-07-20 | Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apac… |
CVE-2026-62183 | Critical | 9.8 | 2026-07-20 | Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adap… |
CVE-2026-59238 | | 2026-07-20 | Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pente… | |
CVE-2026-57308 | Critical | 9.8 | 2026-07-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitleme… |
CVE-2026-54910 | High | 7.7 | 2026-07-20 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) a… |
CVE-2026-54685 | Medium | 5.3 | 2026-07-20 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute… |
CVE-2026-53421 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution th… |
CVE-2026-53405 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process defi… |
CVE-2026-52349 | High | 7.8 | 2026-07-20 | Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via t… |
CVE-2026-46516 | | 2026-07-20 | Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted… | |
CVE-2026-46410 | | 2026-07-20 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source… | |
CVE-2026-45270 | High | 8.7 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation… |
CVE-2026-45139 | Medium | 6.5 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','j… |
CVE-2026-16277 | Medium | 6.5 | 2026-07-20 | A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by… |
CVE-2026-16252 | High | 7.3 | 2026-07-20 | A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function… |
CVE-2026-12701 | Critical | 9.0 | 2026-07-20 | A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to… |
CVE-2026-57311 | | 2026-07-20 | Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Executio… | |
CVE-2026-57310 | | 2026-07-20 | Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode use… |