2026 CVEs (page 118)
Page 118 of 462 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16405 | High | 7.5 | 2026-07-21 | Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbi… |
CVE-2026-16404 | High | 7.4 | 2026-07-21 | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16403 | Medium | 6.5 | 2026-07-21 | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16402 | Critical | 9.8 | 2026-07-21 | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16401 | High | 8.8 | 2026-07-21 | Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16400 | High | 7.5 | 2026-07-21 | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16399 | High | 7.5 | 2026-07-21 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16398 | High | 7.5 | 2026-07-21 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16397 | Medium | 6.5 | 2026-07-21 | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16396 | High | 8.8 | 2026-07-21 | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16395 | Critical | 9.8 | 2026-07-21 | Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16394 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16393 | Critical | 9.1 | 2026-07-21 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16392 | Critical | 9.1 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16391 | High | 7.5 | 2026-07-21 | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 1… |
CVE-2026-16390 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.1… |
CVE-2026-16389 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16388 | Critical | 9.8 | 2026-07-21 | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16387 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16386 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16385 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16384 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16383 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16382 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16381 | Critical | 9.1 | 2026-07-21 | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 1… |
CVE-2026-16380 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16379 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird… |
CVE-2026-16378 | High | 7.5 | 2026-07-21 | Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16377 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16376 | High | 7.5 | 2026-07-21 | Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16375 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.1… |
CVE-2026-16374 | High | 7.5 | 2026-07-21 | Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbir… |
CVE-2026-16373 | High | 7.5 | 2026-07-21 | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16372 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16371 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16370 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16369 | Critical | 9.8 | 2026-07-21 | Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 14… |
CVE-2026-16368 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and T… |
CVE-2026-16367 | Critical | 10.0 | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16366 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16365 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16364 | Critical | 9.1 | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16363 | Critical | 9.8 | 2026-07-21 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird… |
CVE-2026-16362 | High | 8.8 | 2026-07-21 | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16361 | Critical | 9.8 | 2026-07-21 | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of th… |
CVE-2026-16360 | Critical | 9.8 | 2026-07-21 | Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume th… |
CVE-2026-16359 | Critical | 9.1 | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbi… |
CVE-2026-16358 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16357 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16356 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16355 | Critical | 9.8 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-16354 | High | 7.5 | 2026-07-21 | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-16353 | Critical | 9.8 | 2026-07-21 | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16352 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16351 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thu… |
CVE-2026-16350 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunder… |
CVE-2026-16349 | Critical | 9.8 | 2026-07-21 | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-65009 | Medium | 4.3 | 2026-07-21 | OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by… |
CVE-2026-65008 | Critical | 9.8 | 2026-07-21 | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passe… |
CVE-2026-65007 | Critical | 9.6 | 2026-07-21 | The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiK… |
CVE-2026-64628 | Medium | 5.4 | 2026-07-21 | Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing li… |
CVE-2026-64627 | | 2026-07-21 | Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with… | |
CVE-2026-60080 | High | 7.3 | 2026-07-21 | Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory paylo… |
CVE-2026-59845 | Medium | 5.3 | 2026-07-21 | A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent acr… |
CVE-2026-59844 | Medium | 6.5 | 2026-07-21 | A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to all… |
CVE-2026-59843 | Medium | 6.5 | 2026-07-21 | A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop… |
CVE-2026-59842 | Low | 3.7 | 2026-07-21 | A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without… |
CVE-2026-1617 | Critical | 9.8 | 2026-07-21 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Log… |
CVE-2026-16461 | Medium | 6.5 | 2026-07-21 | A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_D… |
CVE-2026-64606 | Critical | 9.8 | 2026-07-21 | Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture… |
CVE-2026-64609 | Critical | 9.1 | 2026-07-21 | Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of t… |
CVE-2026-64608 | Critical | 9.8 | 2026-07-21 | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not… |
CVE-2026-62415 | Critical | 9.1 | 2026-07-21 | Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by de… |
CVE-2026-1771 | High | 7.2 | 2026-07-21 | The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, a… |
CVE-2026-1372 | Medium | 4.3 | 2026-07-21 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing c… |
CVE-2026-15370 | Medium | 6.7 | 2026-07-21 | A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. W… |
CVE-2026-15145 | Medium | 6.4 | 2026-07-21 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Wid… |
CVE-2026-8593 | | 2026-07-21 | Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without pe… | |
CVE-2026-3183 | High | 7.1 | 2026-07-21 | Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass. |
CVE-2026-8082 | High | 7.5 | 2026-07-21 | The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submis… |
CVE-2026-14185 | Medium | 4.3 | 2026-07-21 | The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing… |
CVE-2026-14184 | Medium | 5.4 | 2026-07-21 | The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing aut… |
CVE-2026-14183 | Medium | 4.3 | 2026-07-21 | The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, al… |
CVE-2026-13694 | Medium | 6.5 | 2026-07-21 | The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthent… |
CVE-2026-13693 | Medium | 5.9 | 2026-07-21 | The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification… |
CVE-2026-11767 | High | 8.8 | 2026-07-21 | The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in… |
CVE-2026-3182 | Medium | 4.3 | 2026-07-21 | Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability. |
CVE-2026-16266 | Medium | 4.0 | 2026-07-21 | Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the Jav… |
CVE-2026-15927 | Medium | 6.8 | 2026-07-21 | A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_refer… |
CVE-2026-15812 | Medium | 4.8 | 2026-07-21 | A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34). When the framework is explicitly config… |
CVE-2026-15811 | Medium | 5.8 | 2026-07-21 | A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive m… |
CVE-2026-15782 | Medium | 4.9 | 2026-07-21 | The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Sc… |
CVE-2026-13439 | Critical | 9.8 | 2026-07-21 | The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and includi… |
CVE-2026-15156 | Medium | 6.4 | 2026-07-21 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progre… |
CVE-2026-59776 | Medium | 6.8 | 2026-07-21 | Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information… |
CVE-2026-16336 | Medium | 4.3 | 2026-07-21 | A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java… |
CVE-2026-6952 | High | 7.2 | 2026-07-21 | A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7… |
CVE-2026-63729 | Medium | 6.6 | 2026-07-21 | The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerabil… |
CVE-2026-16334 | Medium | 6.3 | 2026-07-21 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such… |
CVE-2026-16332 | High | 7.3 | 2026-07-21 | A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of t… |