2026 CVEs (page 112)
Page 112 of 664 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45768 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-45767 | Medium | 4.4 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a mal… |
CVE-2026-45766 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certa… |
CVE-2026-45765 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3… |
CVE-2026-45764 | Critical | 9.1 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a pro… |
CVE-2026-45762 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suric… |
CVE-2026-36392 | Medium | 5.4 | 2026-09-10 | FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's ti… |
CVE-2026-2310 | High | 7.8 | 2026-09-10 | IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A re… |
CVE-2026-19646 | Critical | 9.1 | 2026-09-10 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbit… |
CVE-2026-9667 | Medium | 5.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause… |
CVE-2026-9327 | Medium | 6.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This… |
CVE-2026-9225 | Medium | 6.5 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access… |
CVE-2026-9176 | Medium | 6.7 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this v… |
CVE-2026-89094 | Critical | 9.9 | 2026-09-10 | Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. |
CVE-2026-89089 | Medium | 6.5 | 2026-09-10 | A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authen… |
CVE-2026-85025 | Critical | 9.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through pub… |
CVE-2026-79592 | High | 7.5 | 2026-09-10 | An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offs… |
CVE-2026-79591 | High | 7.8 | 2026-09-10 | A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled… |
CVE-2026-76653 | | 2026-09-10 | A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper a… | |
CVE-2026-76652 | | 2026-09-10 | An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insu… | |
CVE-2026-75940 | Critical | 9.1 | 2026-09-10 | A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensit… |
CVE-2026-63427 | High | 7.8 | 2026-09-10 | An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution wi… |
CVE-2026-45761 | Low | 3.3 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a cra… |
CVE-2026-45759 | High | 7.5 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suric… |
CVE-2026-45752 | Medium | 5.9 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-45751 | Medium | 5.9 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suric… |
CVE-2026-3096 | Medium | 4.7 | 2026-09-10 | The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly… |
CVE-2026-19596 | Medium | 5.9 | 2026-09-10 | An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a s… |
CVE-2026-19136 | High | 7.8 | 2026-09-10 | A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow… |
CVE-2026-18994 | High | 7.1 | 2026-09-10 | A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, th… |
CVE-2026-11813 | High | 7.8 | 2026-09-10 | A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate priv… |
CVE-2026-89087 | High | 7.3 | 2026-09-10 | The cstruct package before 6.3.0 for OCaml mishandles indexes. |
CVE-2026-89086 | Critical | 9.1 | 2026-09-10 | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the… |
CVE-2026-89054 | High | 8.2 | 2026-09-10 | A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST A… |
CVE-2026-89011 | High | 7.1 | 2026-09-10 | isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute… |
CVE-2026-88062 | | 2026-09-10 | OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents cust… | |
CVE-2026-88061 | | 2026-09-10 | career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-sp… | |
CVE-2026-84432 | | 2026-09-10 | Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller (concrete/controllers/dialog/board/custom_slot.ph… | |
CVE-2026-9338 | Medium | 5.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could expl… |
CVE-2026-9336 | Medium | 6.5 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative end… |
CVE-2026-89049 | Critical | 9.9 | 2026-09-10 | A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Am… |
CVE-2026-88060 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88059 | Medium | 4.0 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20… |
CVE-2026-88058 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88057 | Medium | 6.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20… |
CVE-2026-88056 | Critical | 9.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88036 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file ide… |
CVE-2026-88035 | Medium | 4.7 | 2026-09-10 | A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past… |
CVE-2026-88034 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file i… |
CVE-2026-88033 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file… |
CVE-2026-88032 | Medium | 5.9 | 2026-09-10 | A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted… |
CVE-2026-88021 | High | 7.1 | 2026-09-10 | Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not au… |
CVE-2026-87993 | High | 7.7 | 2026-09-10 | The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in templat… |
CVE-2026-87107 | Medium | 5.4 | 2026-09-10 | Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-impor… |
CVE-2026-87106 | Medium | 6.5 | 2026-09-10 | Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory b… |
CVE-2026-87090 | High | 8.3 | 2026-09-10 | Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete anothe… |
CVE-2026-68527 | | 2026-09-10 | Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.p… | |
CVE-2026-89046 | High | 8.2 | 2026-09-10 | zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition… |
CVE-2026-89045 | Medium | 4.0 | 2026-09-10 | zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infi… |
CVE-2026-89044 | Medium | 6.5 | 2026-09-10 | Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-En… |
CVE-2026-89043 | High | 7.4 | 2026-09-10 | passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent X… |
CVE-2026-89042 | Critical | 9.1 | 2026-09-10 | passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by… |
CVE-2026-88055 | Medium | 5.5 | 2026-09-10 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager… |
CVE-2026-88054 | Medium | 5.5 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks b… |
CVE-2026-88053 | High | 7.8 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses… |
CVE-2026-88052 | High | 7.8 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count… |
CVE-2026-88051 | High | 7.8 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independ… |
CVE-2026-88031 | High | 8.1 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file id… |
CVE-2026-88030 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file… |
CVE-2026-88029 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured fil… |
CVE-2026-88028 | Medium | 6.5 | 2026-09-10 | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-… |
CVE-2026-88027 | High | 7.1 | 2026-09-10 | Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a c… |
CVE-2026-88026 | Medium | 6.5 | 2026-09-10 | Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied chara… |
CVE-2026-88025 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file id… |
CVE-2026-88024 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file… |
CVE-2026-88023 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file… |
CVE-2026-88022 | High | 7.7 | 2026-09-10 | Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filt… |
CVE-2026-68006 | Critical | 9.1 | 2026-09-10 | An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file |
CVE-2026-15419 | | 2026-09-10 | In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kerne… | |
CVE-2026-15418 | | 2026-09-10 | In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 14… | |
CVE-2026-15417 | | 2026-09-10 | In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash. | |
CVE-2026-88050 | Medium | 5.5 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts… |
CVE-2026-88049 | Medium | 5.5 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and Ne… |
CVE-2026-88048 | High | 7.1 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserial… |
CVE-2026-88047 | High | 7.8 | 2026-09-10 | Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in src/classify/normmatch.cpp parses the NORMPROTO component of… |
CVE-2026-88046 | Medium | 5.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject pare… |
CVE-2026-88045 | High | 7.5 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed m… |
CVE-2026-88044 | Critical | 9.1 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC inte… |
CVE-2026-85228 | Critical | 9.1 | 2026-09-10 | An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remot… |
CVE-2026-73699 | High | 7.2 | 2026-09-10 | FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect opt… |
CVE-2026-73698 | High | 7.2 | 2026-09-10 | FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the descri… |
CVE-2026-73694 | High | 7.2 | 2026-09-10 | FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metachar… |
CVE-2026-73693 | High | 8.8 | 2026-09-10 | FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to… |
CVE-2026-68488 | Critical | 9.9 | 2026-09-10 | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file… |
CVE-2026-68487 | Critical | 9.9 | 2026-09-10 | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. |
CVE-2026-65639 | | 2026-09-10 | OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to exec… | |
CVE-2026-65638 | | 2026-09-10 | Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF serv… | |
CVE-2026-52098 | Critical | 9.8 | 2026-09-10 | An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint |
CVE-2026-52097 | Medium | 6.8 | 2026-09-10 | An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, loca… |
CVE-2026-88959 | High | 8.8 | 2026-09-10 | Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to creat… |