2026 CVEs (page 12)
Page 12 of 444 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57471 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management f… | |
CVE-2026-57469 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version… | |
CVE-2026-53970 | High | 7.5 | 2026-08-14 | ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execut… |
CVE-2026-19884 | | 2026-08-14 | In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first… | |
CVE-2026-19837 | Low | 2.7 | 2026-08-14 | A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search… |
CVE-2026-19836 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of th… |
CVE-2026-19835 | Low | 3.8 | 2026-08-14 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletio… |
CVE-2026-19834 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component… |
CVE-2026-16772 | High | 8.1 | 2026-08-14 | In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administ… |
CVE-2026-13198 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the eve… | |
CVE-2026-13197 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the con… | |
CVE-2026-13196 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2… | |
CVE-2026-13002 | Medium | 4.4 | 2026-08-14 | A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dns… |
CVE-2026-69101 | High | 7.7 | 2026-08-14 | Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery an… |
CVE-2026-58224 | Medium | 6.5 | 2026-08-14 | A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malf… |
CVE-2026-19880 | | 2026-08-14 | Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-ba… | |
CVE-2026-19879 | Medium | 5.3 | 2026-08-14 | A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16… |
CVE-2026-73633 | High | 7.5 | 2026-08-14 | Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request… |
CVE-2026-53472 | Medium | 6.3 | 2026-08-14 | A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malic… |
CVE-2026-1621 | Medium | 5.3 | 2026-08-14 | Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers. This issue affec… |
CVE-2026-19871 | | 2026-08-14 | Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticat… | |
CVE-2026-19830 | Medium | 5.3 | 2026-08-14 | A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component… |
CVE-2026-19829 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the… |
CVE-2026-19828 | Medium | 6.3 | 2026-08-14 | A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snaps… |
CVE-2026-19827 | Medium | 5.3 | 2026-08-14 | A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of th… |
CVE-2026-19768 | High | 8.1 | 2026-08-14 | Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authentica… |
CVE-2026-73673 | High | 8.8 | 2026-08-14 | Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmw… |
CVE-2026-19870 | | 2026-08-14 | Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read p… | |
CVE-2026-19826 | High | 7.3 | 2026-08-14 | A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerial… |
CVE-2026-19825 | High | 7.3 | 2026-08-14 | A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /clas… |
CVE-2026-19824 | High | 8.8 | 2026-08-14 | A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIp… |
CVE-2026-19823 | High | 8.8 | 2026-08-14 | A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the co… |
CVE-2026-73630 | Medium | 5.8 | 2026-08-14 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth o… |
CVE-2026-73051 | | 2026-08-14 | actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Tra… | |
CVE-2026-73049 | Medium | 5.8 | 2026-08-14 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list… |
CVE-2026-73048 | Medium | 5.8 | 2026-08-14 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing… |
CVE-2026-72859 | High | 7.7 | 2026-08-14 | Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject… |
CVE-2026-72838 | Medium | 6.5 | 2026-08-14 | FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to writ… |
CVE-2026-72837 | High | 8.8 | 2026-08-14 | File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid u… |
CVE-2026-72836 | High | 8.1 | 2026-08-14 | FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and C… |
CVE-2026-72835 | Medium | 6.8 | 2026-08-14 | filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined de… |
CVE-2026-72834 | Medium | 4.3 | 2026-08-14 | filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire… |
CVE-2026-72833 | High | 8.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-… |
CVE-2026-72832 | Medium | 5.4 | 2026-08-14 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Secur… |
CVE-2026-72831 | High | 8.8 | 2026-08-14 | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController… |
CVE-2026-72830 | Critical | 9.8 | 2026-08-14 | Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler config… |
CVE-2026-72829 | Critical | 9.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These meth… |
CVE-2026-72828 | High | 7.2 | 2026-08-14 | Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisio… |
CVE-2026-72827 | High | 8.8 | 2026-08-14 | Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute ar… |
CVE-2026-72826 | Critical | 9.8 | 2026-08-14 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiK… |
CVE-2026-72825 | High | 7.6 | 2026-08-14 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController)… |
CVE-2026-72824 | Critical | 9.8 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check… |
CVE-2026-72823 | Medium | 5.4 | 2026-08-14 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks is… |
CVE-2026-72822 | Critical | 9.8 | 2026-08-14 | The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibl… |
CVE-2026-72821 | Medium | 5.4 | 2026-08-14 | Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw… |
CVE-2026-72820 | Medium | 4.9 | 2026-08-14 | Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the ha… |
CVE-2026-72819 | High | 8.8 | 2026-08-14 | Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute… |
CVE-2026-72817 | Medium | 6.5 | 2026-08-14 | go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr… |
CVE-2026-72816 | Medium | 6.5 | 2026-08-14 | go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled h… |
CVE-2026-72815 | | 2026-08-14 | go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of… | |
CVE-2026-72814 | | 2026-08-14 | The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_fro… | |
CVE-2026-72813 | | 2026-08-14 | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to… | |
CVE-2026-72812 | Medium | 6.5 | 2026-08-14 | SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger p… |
CVE-2026-72811 | Critical | 10.0 | 2026-08-14 | SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored bloc… |
CVE-2026-72810 | High | 8.6 | 2026-08-14 | SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfilter… |
CVE-2026-19822 | High | 8.8 | 2026-08-14 | A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the function lstAdd of the file /goform/editQos of the compone… |
CVE-2026-19821 | High | 8.8 | 2026-08-14 | A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoR… |
CVE-2026-19815 | High | 8.8 | 2026-08-14 | A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cg… |
CVE-2026-19814 | High | 8.8 | 2026-08-14 | A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component fir… |
CVE-2026-19813 | High | 8.8 | 2026-08-14 | A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.c… |
CVE-2026-19812 | High | 8.8 | 2026-08-14 | A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the c… |
CVE-2026-19794 | High | 7.2 | 2026-08-14 | The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitizatio… |
CVE-2026-19811 | High | 8.8 | 2026-08-14 | A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.c… |
CVE-2026-19617 | Medium | 5.5 | 2026-08-14 | A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This cou… |
CVE-2026-18039 | High | 8.1 | 2026-08-14 | The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attribut… |
CVE-2026-16810 | Medium | 6.5 | 2026-08-14 | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via… |
CVE-2026-16739 | Medium | 5.9 | 2026-08-14 | The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the target… |
CVE-2026-15205 | High | 8.6 | 2026-08-14 | The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its publ… |
CVE-2026-14290 | Medium | 6.8 | 2026-08-14 | The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowin… |
CVE-2026-12949 | Critical | 9.8 | 2026-08-14 | The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3… |
CVE-2026-12743 | Medium | 4.9 | 2026-08-14 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' param… |
CVE-2026-19792 | High | 8.8 | 2026-08-14 | A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web m… |
CVE-2026-19791 | High | 8.8 | 2026-08-14 | A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component http… |
CVE-2026-19790 | High | 8.8 | 2026-08-14 | A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd… |
CVE-2026-19789 | High | 8.8 | 2026-08-14 | A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects the function set_wl_guest_iplist of the file /goform/WifiGues… |
CVE-2026-19788 | High | 8.8 | 2026-08-14 | A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the compone… |
CVE-2026-19787 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_… |
CVE-2026-19786 | Medium | 4.3 | 2026-08-14 | A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulati… |
CVE-2026-19785 | Medium | 6.3 | 2026-08-14 | A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medica… |
CVE-2026-19784 | Medium | 4.3 | 2026-08-14 | A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation caus… |
CVE-2026-18109 | High | 7.2 | 2026-08-14 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due t… |
CVE-2026-19771 | High | 7.2 | 2026-08-14 | A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web I… |
CVE-2026-19770 | Medium | 5.3 | 2026-08-14 | A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/… |
CVE-2026-19767 | Medium | 6.3 | 2026-08-14 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Ex… |
CVE-2026-19765 | Medium | 6.3 | 2026-08-14 | A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSour… |
CVE-2026-19764 | High | 7.3 | 2026-08-14 | A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/us… |
CVE-2026-19763 | Low | 3.8 | 2026-08-14 | A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of t… |
CVE-2026-19762 | High | 7.3 | 2026-08-14 | A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component… |
CVE-2026-19761 | Medium | 4.7 | 2026-08-14 | A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the comp… |
CVE-2026-19758 | High | 7.3 | 2026-08-14 | A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the compo… |