2026 CVEs (page 114)
Page 114 of 664 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-88865 | High | 8.1 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with… |
CVE-2026-88864 | Critical | 9.1 | 2026-09-10 | Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo ful… |
CVE-2026-88863 | High | 8.1 | 2026-09-10 | capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of… |
CVE-2026-88862 | High | 8.8 | 2026-09-10 | Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg() in supabase/… |
CVE-2026-88861 | High | 8.3 | 2026-09-10 | Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization… |
CVE-2026-88860 | Medium | 6.3 | 2026-09-10 | Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can ret… |
CVE-2026-88790 | Medium | 4.8 | 2026-09-10 | A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/f… |
CVE-2026-85217 | High | 8.6 | 2026-09-10 | A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or… |
CVE-2026-75584 | High | 7.5 | 2026-09-10 | ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bun… |
CVE-2026-6285 | High | 7.5 | 2026-09-10 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploita… |
CVE-2026-64838 | High | 8.3 | 2026-09-10 | ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate… |
CVE-2026-64837 | High | 8.8 | 2026-09-10 | ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through… |
CVE-2026-64836 | High | 8.8 | 2026-09-10 | ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check… |
CVE-2026-45763 | Medium | 5.9 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to ve… |
CVE-2026-38626 | Critical | 9.8 | 2026-09-10 | Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. |
CVE-2026-12683 | Medium | 5.4 | 2026-09-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allo… |
CVE-2026-12682 | Medium | 5.4 | 2026-09-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allo… |
CVE-2026-9166 | High | 7.5 | 2026-09-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GIS Informatics GisLab Laboratory Management System allows Path… |
CVE-2026-9163 | Critical | 9.8 | 2026-09-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allow… |
CVE-2026-9161 | Medium | 5.3 | 2026-09-10 | Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 1009202… |
CVE-2026-88038 | Medium | 4.8 | 2026-09-10 | cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name… |
CVE-2026-85545 | High | 7.1 | 2026-09-10 | There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not author… |
CVE-2026-85544 | Medium | 6.1 | 2026-09-10 | Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within… |
CVE-2026-85543 | Medium | 4.3 | 2026-09-10 | Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device W… |
CVE-2026-17038 | | 2026-09-10 | DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the t… | |
CVE-2026-88859 | Medium | 6.3 | 2026-09-10 | A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. W… |
CVE-2026-84828 | Medium | 6.5 | 2026-09-10 | A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' comm… |
CVE-2026-87962 | High | 7.5 | 2026-09-10 | t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from s… |
CVE-2026-87961 | High | 7.1 | 2026-09-10 | ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length para… |
CVE-2026-78085 | | 2026-09-10 | Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked director… | |
CVE-2026-87803 | High | 7.1 | 2026-09-10 | An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db… |
CVE-2026-78374 | | 2026-09-10 | Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes a… | |
CVE-2026-78303 | | 2026-09-10 | Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously… | |
CVE-2026-78302 | | 2026-09-10 | Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4 - Mu… | |
CVE-2026-78084 | | 2026-09-10 | Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked… | |
CVE-2026-78083 | | 2026-09-10 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor bookin… | |
CVE-2026-78082 | | 2026-09-10 | Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing… | |
CVE-2026-5399 | Medium | 6.4 | 2026-09-10 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and inclu… |
CVE-2026-15889 | Medium | 6.4 | 2026-09-10 | The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due… |
CVE-2026-8323 | Critical | 9.3 | 2026-09-10 | URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of D… |
CVE-2026-88290 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing… |
CVE-2026-88289 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple… |
CVE-2026-88288 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary f… |
CVE-2026-88287 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corru… |
CVE-2026-88286 | High | 7.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ conn… |
CVE-2026-88285 | Critical | 9.4 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and iss… |
CVE-2026-88284 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control… |
CVE-2026-88283 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack cont… |
CVE-2026-88282 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a s… |
CVE-2026-88281 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack… |
CVE-2026-88280 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF work… |
CVE-2026-88279 | Medium | 4.9 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed stack fields, allowing an authenticated administrator to c… |
CVE-2026-88278 | Critical | 9.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be repla… |
CVE-2026-88277 | High | 8.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root. |
CVE-2026-88276 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. |
CVE-2026-88275 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wireless configuration… |
CVE-2026-88274 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. |
CVE-2026-88273 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands… |
CVE-2026-88272 | High | 7.2 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the store… |
CVE-2026-88271 | High | 8.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. |
CVE-2026-88270 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. |
CVE-2026-88269 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSV… |
CVE-2026-88268 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service. |
CVE-2026-88265 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file… |
CVE-2026-88264 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-cont… |
CVE-2026-84042 | High | 7.8 | 2026-09-10 | A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-… |
CVE-2026-59679 | Critical | 9.0 | 2026-09-10 | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 r… |
CVE-2026-44950 | Critical | 9.0 | 2026-09-10 | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the… |
CVE-2026-42808 | Medium | 6.8 | 2026-09-10 | An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sensor_data()}} fails… |
CVE-2026-42807 | High | 8.0 | 2026-09-10 | A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to ca… |
CVE-2026-42806 | Medium | 4.3 | 2026-09-10 | An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data par… |
CVE-2026-42805 | High | 8.4 | 2026-09-10 | A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_de… |
CVE-2026-42804 | High | 7.6 | 2026-09-10 | A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The… |
CVE-2026-13745 | | 2026-09-10 | A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI withi… | |
CVE-2026-88770 | Medium | 6.5 | 2026-09-10 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption… |
CVE-2026-88763 | Medium | 5.9 | 2026-09-10 | A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. T… |
CVE-2026-80354 | High | 8.1 | 2026-09-10 | Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tena… |
CVE-2026-80352 | Critical | 9.8 | 2026-09-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration a… |
CVE-2026-80351 | Critical | 9.8 | 2026-09-10 | Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of direct… |
CVE-2026-7188 | Critical | 9.8 | 2026-09-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information Technologies Ltd. Co. Access Control S… |
CVE-2026-82925 | High | 8.1 | 2026-09-10 | The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out t… |
CVE-2026-82582 | Medium | 4.3 | 2026-09-10 | An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the gr… |
CVE-2026-81635 | Medium | 5.4 | 2026-09-10 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses… |
CVE-2026-81431 | High | 7.2 | 2026-09-10 | The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration… |
CVE-2026-78361 | Critical | 9.1 | 2026-09-10 | The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request ha… |
CVE-2026-77771 | High | 7.5 | 2026-09-10 | The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account b… |
CVE-2026-77770 | Critical | 10.0 | 2026-09-10 | The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site o… |
CVE-2026-19840 | Medium | 6.5 | 2026-09-10 | The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user… |
CVE-2026-19439 | High | 7.5 | 2026-09-10 | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauth… |
CVE-2026-19436 | High | 7.5 | 2026-09-10 | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actual… |
CVE-2026-0304 | | 2026-09-10 | A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) acce… | |
CVE-2026-0303 | | 2026-09-10 | A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains a… | |
CVE-2026-0302 | | 2026-09-10 | An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes runnin… | |
CVE-2026-85645 | Medium | 6.1 | 2026-09-10 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_ac… |
CVE-2026-84939 | Critical | 9.1 | 2026-09-10 | Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarke… |
CVE-2026-82079 | High | 8.4 | 2026-09-10 | A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execu… |
CVE-2026-0310 | | 2026-09-10 | A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network acc… | |
CVE-2026-0309 | | 2026-09-10 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… | |
CVE-2026-0308 | | 2026-09-10 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a… | |
CVE-2026-0307 | | 2026-09-10 | Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORI… |