2026 CVEs (page 116)
Page 116 of 462 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63136 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges… |
CVE-2026-63092 | Medium | 4.3 | 2026-07-21 | kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrie… |
CVE-2026-63080 | Medium | 6.5 | 2026-07-21 | Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data a… |
CVE-2026-56147 | High | 7.1 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise v… |
CVE-2026-52476 | High | 7.5 | 2026-07-21 | SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java… |
CVE-2026-52475 | Medium | 6.1 | 2026-07-21 | Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file |
CVE-2026-52474 | High | 7.5 | 2026-07-21 | An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file. |
CVE-2026-52472 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file |
CVE-2026-52470 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file |
CVE-2026-52469 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file |
CVE-2026-47714 | Medium | 6.1 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integ… |
CVE-2026-47708 | | 2026-07-21 | MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI… | |
CVE-2026-47697 | High | 7.1 | 2026-07-21 | Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoi… |
CVE-2026-47695 | | 2026-07-21 | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.req… | |
CVE-2026-47690 | High | 7.5 | 2026-07-21 | MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3… |
CVE-2026-47689 | Medium | 4.6 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method… |
CVE-2026-47688 | High | 8.2 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clea… |
CVE-2026-47687 | High | 7.3 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helpe… |
CVE-2026-47685 | High | 7.3 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inve… |
CVE-2026-47237 | High | 8.0 | 2026-07-21 | Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on… |
CVE-2026-47143 | Medium | 5.1 | 2026-07-21 | Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassem… |
CVE-2026-46556 | Medium | 6.5 | 2026-07-21 | FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in ge… |
CVE-2026-45383 | | 2026-07-21 | libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow (out-of-bounds READ) exists in `decode… | |
CVE-2026-45382 | | 2026-07-21 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920… | |
CVE-2026-44879 | High | 7.2 | 2026-07-21 | A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on ce… |
CVE-2026-44878 | High | 7.2 | 2026-07-21 | A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's f… |
CVE-2026-30633 | High | 7.5 | 2026-07-21 | Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools. |
CVE-2026-30631 | Critical | 9.8 | 2026-07-21 | An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted… |
CVE-2026-16318 | Medium | 5.3 | 2026-07-21 | The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a T… |
CVE-2026-16317 | Medium | 6.5 | 2026-07-21 | Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual app… |
CVE-2026-12139 | Medium | 4.4 | 2026-07-21 | Tanium addressed an information disclosure vulnerability in Connect. |
CVE-2026-11925 | Low | 2.7 | 2026-07-21 | Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server. |
CVE-2026-65069 | Medium | 4.0 | 2026-07-21 | Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is cre… |
CVE-2026-65068 | Low | 3.8 | 2026-07-21 | Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is cre… |
CVE-2026-65067 | Low | 3.8 | 2026-07-21 | Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created… |
CVE-2026-65066 | Low | 3.8 | 2026-07-21 | Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is crea… |
CVE-2026-65065 | Medium | 5.5 | 2026-07-21 | Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is c… |
CVE-2026-65064 | Low | 3.8 | 2026-07-21 | Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created… |
CVE-2026-65063 | Low | 3.8 | 2026-07-21 | Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is creat… |
CVE-2026-65062 | Low | 3.8 | 2026-07-21 | Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is creat… |
CVE-2026-65061 | Low | 3.8 | 2026-07-21 | Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created… |
CVE-2026-64880 | High | 7.1 | 2026-07-21 | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enab… |
CVE-2026-64879 | Critical | 9.9 | 2026-07-21 | A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharac… |
CVE-2026-64878 | Critical | 9.9 | 2026-07-21 | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privi… |
CVE-2026-64617 | Low | 3.8 | 2026-07-21 | Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created… |
CVE-2026-64616 | Low | 3.3 | 2026-07-21 | Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created… |
CVE-2026-64615 | Low | 3.3 | 2026-07-21 | Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created i… |
CVE-2026-64614 | Low | 3.8 | 2026-07-21 | Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created i… |
CVE-2026-64613 | Medium | 6.2 | 2026-07-21 | Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. The segment is created in buf_gen… |
CVE-2026-59147 | Critical | 9.8 | 2026-07-21 | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time vali… |
CVE-2026-59146 | High | 7.8 | 2026-07-21 | Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cel… |
CVE-2026-59145 | Critical | 9.1 | 2026-07-21 | Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find. The attach-time… |
CVE-2026-59144 | Critical | 9.8 | 2026-07-21 | Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq. The attach-time validator… |
CVE-2026-59143 | Medium | 6.3 | 2026-07-21 | Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked… |
CVE-2026-56852 | High | 7.5 | 2026-07-21 | A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. |
CVE-2026-56146 | Medium | 5.4 | 2026-07-21 | Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclos… |
CVE-2026-56145 | Medium | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated… |
CVE-2026-56144 | Medium | 5.3 | 2026-07-21 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls… |
CVE-2026-50759 | High | 7.5 | 2026-07-21 | An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no auth… |
CVE-2026-50758 | High | 8.1 | 2026-07-21 | Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter |
CVE-2026-50757 | High | 7.8 | 2026-07-21 | Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server |
CVE-2026-50756 | High | 7.5 | 2026-07-21 | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component |
CVE-2026-50755 | Critical | 9.8 | 2026-07-21 | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value |
CVE-2026-49092 | Medium | 4.3 | 2026-07-21 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly… |
CVE-2026-47671 | Medium | 5.4 | 2026-07-21 | Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` expose… |
CVE-2026-47667 | High | 7.5 | 2026-07-21 | CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the fi… |
CVE-2026-46600 | High | 7.5 | 2026-07-21 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. |
CVE-2026-46403 | Medium | 6.3 | 2026-07-21 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution… |
CVE-2026-42397 | Medium | 6.5 | 2026-07-21 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-30632 | High | 7.5 | 2026-07-21 | Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. |
CVE-2026-15957 | High | 7.5 | 2026-07-21 | Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for R… |
CVE-2026-64877 | High | 8.4 | 2026-07-21 | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. |
CVE-2026-63454 | High | 7.2 | 2026-07-21 | An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a u… |
CVE-2026-63453 | High | 7.2 | 2026-07-21 | Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privi… |
CVE-2026-59142 | Critical | 9.1 | 2026-07-21 | Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy. The attach-time va… |
CVE-2026-59141 | Critical | 9.1 | 2026-07-21 | Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked. The attach-time v… |
CVE-2026-59140 | Critical | 9.1 | 2026-07-21 | Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach… |
CVE-2026-59139 | Critical | 9.1 | 2026-07-21 | Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-ti… |
CVE-2026-55084 | High | 8.8 | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in t… |
CVE-2026-55082 | | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticat… | |
CVE-2026-55081 | | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values… | |
CVE-2026-16441 | Critical | 9.6 | 2026-07-21 | In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is i… |
CVE-2026-12548 | Medium | 4.2 | 2026-07-21 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse()… |
CVE-2026-12547 | Low | 3.4 | 2026-07-21 | SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., vi… |
CVE-2026-56583 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse. |
CVE-2026-56582 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL pa… |
CVE-2026-56581 | Low | 2.6 | 2026-07-21 | HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens. |
CVE-2026-56580 | Low | 2.2 | 2026-07-21 | HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compr… |
CVE-2026-56579 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's… |
CVE-2026-56578 | Low | 2.2 | 2026-07-21 | HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versio… |
CVE-2026-56577 | Low | 3.1 | 2026-07-21 | HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks. |
CVE-2026-47657 | | 2026-07-21 | HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller… | |
CVE-2026-47425 | | 2026-07-21 | Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types… | |
CVE-2026-47419 | High | 8.3 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The age… |
CVE-2026-47418 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The proj… |
CVE-2026-47417 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comm… |
CVE-2026-47416 | Critical | 9.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. T… |
CVE-2026-47415 | High | 8.3 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issu… |
CVE-2026-47414 | High | 7.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five lab… |
CVE-2026-47413 | Critical | 9.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member i… |