2026 CVEs (page 111)
Page 111 of 452 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57309 | | 2026-07-20 | A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP head… | |
CVE-2026-16248 | High | 8.8 | 2026-07-20 | A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file /goform/AdvSetLanip of the compone… |
CVE-2026-16244 | Medium | 6.3 | 2026-07-20 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2026-12080 | High | 7.3 | 2026-07-20 | A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by m… |
CVE-2026-64623 | High | 8.6 | 2026-07-20 | Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non… |
CVE-2026-64622 | High | 7.5 | 2026-07-20 | Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read r… |
CVE-2026-64621 | High | 7.3 | 2026-07-20 | FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c)… |
CVE-2026-64620 | Critical | 9.8 | 2026-07-20 | FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the mo… |
CVE-2026-63763 | High | 8.8 | 2026-07-20 | SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database… |
CVE-2026-63762 | Medium | 6.5 | 2026-07-20 | SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via… |
CVE-2026-63761 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORIT… |
CVE-2026-63760 | High | 7.5 | 2026-07-20 | SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parenthes… |
CVE-2026-63759 | Medium | 6.5 | 2026-07-20 | SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can sen… |
CVE-2026-63758 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other… |
CVE-2026-63757 | High | 8.8 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentica… |
CVE-2026-63756 | High | 8.1 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit au… |
CVE-2026-63755 | Medium | 6.5 | 2026-07-20 | SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE K… |
CVE-2026-63754 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CRE… |
CVE-2026-63753 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-tim… |
CVE-2026-63752 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwri… |
CVE-2026-63751 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protecte… |
CVE-2026-63750 | Medium | 5.3 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffe… |
CVE-2026-63749 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $b… |
CVE-2026-63748 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by fi… |
CVE-2026-63747 | High | 7.5 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticate… |
CVE-2026-63746 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records f… |
CVE-2026-63745 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing t… |
CVE-2026-63744 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targ… |
CVE-2026-63743 | Medium | 6.4 | 2026-07-20 | SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-ne… |
CVE-2026-63742 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries o… |
CVE-2026-63741 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated… |
CVE-2026-63740 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead… |
CVE-2026-63739 | High | 7.7 | 2026-07-20 | SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles… |
CVE-2026-63738 | Medium | 4.3 | 2026-07-20 | SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals… |
CVE-2026-63737 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of… |
CVE-2026-63736 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists… |
CVE-2026-63735 | High | 8.1 | 2026-07-20 | SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in differe… |
CVE-2026-63734 | Medium | 4.9 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash th… |
CVE-2026-63733 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement… |
CVE-2026-16254 | Medium | 4.3 | 2026-07-20 | A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the sca… |
CVE-2026-16247 | High | 7.3 | 2026-07-20 | In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData… |
CVE-2026-16246 | High | 7.3 | 2026-07-20 | In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control o… |
CVE-2026-15813 | Medium | 6.5 | 2026-07-20 | A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly… |
CVE-2026-15588 | Medium | 5.3 | 2026-07-20 | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforc… |
CVE-2026-14448 | High | 7.2 | 2026-07-20 | An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralizati… |
CVE-2026-2445 | Medium | 6.1 | 2026-07-20 | The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the resp… |
CVE-2026-16242 | Critical | 9.4 | 2026-07-20 | A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and… |
CVE-2026-13577 | High | 8.2 | 2026-07-20 | Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::gener… |
CVE-2026-9833 | High | 7.1 | 2026-07-20 | The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before refl… |
CVE-2026-8825 | Medium | 4.9 | 2026-07-20 | The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoi… |
CVE-2026-6656 | High | 7.5 | 2026-07-20 | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrep… |
CVE-2026-16235 | Critical | 9.8 | 2026-07-20 | Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable… |
CVE-2026-13432 | Medium | 5.4 | 2026-07-20 | The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-leve… |
CVE-2026-13156 | Medium | 5.4 | 2026-07-20 | The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but… |
CVE-2026-13147 | Critical | 9.1 | 2026-07-20 | The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make th… |
CVE-2026-13142 | High | 8.1 | 2026-07-20 | The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordle… |
CVE-2026-12973 | Medium | 6.5 | 2026-07-20 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to… |
CVE-2026-12972 | Medium | 5.3 | 2026-07-20 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to… |
CVE-2026-12970 | High | 7.1 | 2026-07-20 | The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site S… |
CVE-2026-12898 | Medium | 6.5 | 2026-07-20 | The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, all… |
CVE-2026-12724 | Medium | 4.3 | 2026-07-20 | The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the pass… |
CVE-2026-12723 | Medium | 5.3 | 2026-07-20 | The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the c… |
CVE-2026-12592 | High | 7.5 | 2026-07-20 | The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports… |
CVE-2026-11868 | Medium | 5.3 | 2026-07-20 | The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unau… |
CVE-2026-11349 | High | 8.6 | 2026-07-20 | The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request p… |
CVE-2026-10755 | Low | 2.7 | 2026-07-20 | The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-… |
CVE-2026-10724 | Medium | 4.8 | 2026-07-20 | The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through it… |
CVE-2026-10081 | High | 8.8 | 2026-07-20 | The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before renderin… |
CVE-2026-45138 | Medium | 5.4 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog po… |
CVE-2026-44359 | Critical | 10.0 | 2026-07-20 | Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggere… |
CVE-2026-42566 | High | 7.5 | 2026-07-20 | Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed ch… |
CVE-2026-12484 | High | 7.8 | 2026-07-19 | A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.To… |
CVE-2026-64186 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommu_mmio_write() and… |
CVE-2026-64185 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: sysfs: don't remove existing directory on update failure When sysfs_update_group() is cal… |
CVE-2026-64184 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() damon_sysfs_memcg_path_to_id… |
CVE-2026-64183 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: efi: Allocate runtime workqueue before ACPI init Since commit 5894cf571e14 ("acpi/prmt… |
CVE-2026-64182 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference leak in poison accounting memblk_nr_poiso… |
CVE-2026-64181 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() On x… |
CVE-2026-64180 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix memory block reference leak on remove Patch series "mm: Fix memory… |
CVE-2026-64179 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() The memory allocated in ip… |
CVE-2026-64178 | High | 8.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding th… |
CVE-2026-64177 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded sk_receive_skb() The networking receive path is u… |
CVE-2026-64176 | High | 8.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D… |
CVE-2026-64175 | High | 7.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g… |
CVE-2026-64174 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() re… |
CVE-2026-64173 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map->ops->elt_free() if elt_alloc() fails In paths where tracing_map… |
CVE-2026-64172 | High | 7.1 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) Hygon Famil… |
CVE-2026-64171 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: fix pm_runtime leak on mutex_lock failure If tegra_i2c_mutex_lock() fails, th… |
CVE-2026-64170 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mo… |
CVE-2026-64169 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO… |
CVE-2026-64168 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO m… |
CVE-2026-64167 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel kho_fill_kimage() unconditionally populates the kimage wit… |
CVE-2026-64166 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Check for NULL FF-A ID table while driver registration The bus match c… |
CVE-2026-64165 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ARM: integrator: Fix early initialization Starting with commit bdb249fce9ad4 ("ARM: integ… |
CVE-2026-64164 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() The trace even… |
CVE-2026-64163 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: test_kprobes: clear kprobes between test runs Running the kprobes sanity tests twice make… |
CVE-2026-64162 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev… |
CVE-2026-64161 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: fix eth_ports_node leak in probe The error path on of_property_rea… |
CVE-2026-64160 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearin… |
CVE-2026-64159 | Medium | 5.5 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix zeropoint update where i_size > remote_i_size Fix the update of the zero point… |