2026 CVEs (page 128)
Page 128 of 462 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50185 | Low | 3.3 | 2026-07-17 | RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches b… |
CVE-2026-49835 | Medium | 5.9 | 2026-07-17 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.UR… |
CVE-2026-48487 | Medium | 5.3 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protoc… |
CVE-2026-48045 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC… |
CVE-2026-47184 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _… |
CVE-2026-47183 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger except… |
CVE-2026-47180 | Medium | 6.5 | 2026-07-17 | Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name… |
CVE-2026-45703 | Medium | 6.4 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/… |
CVE-2026-45309 | High | 7.5 | 2026-07-17 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prio… |
CVE-2026-45162 | High | 8.0 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data… |
CVE-2026-16073 | Low | 3.5 | 2026-07-17 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.text_to_image/NetworkRenderStrategy… |
CVE-2026-9762 | High | 7.8 | 2026-07-17 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. |
CVE-2026-9202 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true… |
CVE-2026-9198 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/… |
CVE-2026-50273 | High | 7.5 | 2026-07-17 | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagatio… |
CVE-2026-48016 | Medium | 4.3 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChan… |
CVE-2026-48015 | Medium | 4.9 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/confi… |
CVE-2026-48014 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and… |
CVE-2026-48010 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php wr… |
CVE-2026-48009 | Medium | 6.8 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account… |
CVE-2026-48008 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full adminis… |
CVE-2026-9588 | | 2026-07-17 | A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality… | |
CVE-2026-9587 | | 2026-07-17 | An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled i… | |
CVE-2026-9586 | | 2026-07-17 | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <Pol… | |
CVE-2026-9585 | | 2026-07-17 | An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to pr… | |
CVE-2026-8297 | Critical | 9.8 | 2026-07-17 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and… |
CVE-2026-63309 | Medium | 4.3 | 2026-07-17 | SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restrict… |
CVE-2026-63308 | Medium | 4.3 | 2026-07-17 | Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows a… |
CVE-2026-63307 | Medium | 6.5 | 2026-07-17 | Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSour… |
CVE-2026-63101 | High | 7.5 | 2026-07-17 | Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of… |
CVE-2026-57860 | High | 7.8 | 2026-07-17 | ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on star… |
CVE-2026-54496 | Critical | 9.3 | 2026-07-17 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the var… |
CVE-2026-49216 | Medium | 5.4 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response i… |
CVE-2026-49215 | Medium | 5.4 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveCom… |
CVE-2026-49212 | High | 7.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covere… |
CVE-2026-49211 | High | 7.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() build… |
CVE-2026-49210 | Medium | 6.1 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml()… |
CVE-2026-49209 | Medium | 6.5 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke() iter… |
CVE-2026-49208 | Medium | 5.3 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no explicit format is… |
CVE-2026-44722 | Medium | 6.2 | 2026-07-17 | pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zi… |
CVE-2026-21764 | Low | 3.1 | 2026-07-17 | HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended appl… |
CVE-2026-21762 | Low | 3.7 | 2026-07-17 | HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as… |
CVE-2026-21761 | Medium | 4.2 | 2026-07-17 | HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin request… |
CVE-2026-21760 | Medium | 4.6 | 2026-07-17 | HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthori… |
CVE-2026-16108 | Medium | 4.3 | 2026-07-17 | A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatic… |
CVE-2026-16106 | Medium | 4.9 | 2026-07-17 | A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to… |
CVE-2026-16104 | Medium | 4.3 | 2026-07-17 | A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identi… |
CVE-2026-16103 | Medium | 4.3 | 2026-07-17 | A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were ad… |
CVE-2026-16093 | Medium | 5.4 | 2026-07-17 | Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication… |
CVE-2026-12694 | Critical | 9.1 | 2026-07-17 | Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue aff… |
CVE-2026-12693 | Critical | 9.4 | 2026-07-17 | Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrain… |
CVE-2026-12692 | Critical | 9.8 | 2026-07-17 | Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform… |
CVE-2026-12691 | High | 7.5 | 2026-07-17 | Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterpr… |
CVE-2026-11763 | Medium | 6.5 | 2026-07-17 | Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Labor… |
CVE-2026-9537 | Medium | 5.3 | 2026-07-17 | Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature… |
CVE-2026-63100 | Medium | 6.5 | 2026-07-17 | Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hostin… |
CVE-2026-63099 | Medium | 6.5 | 2026-07-17 | TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to ac… |
CVE-2026-63098 | Medium | 5.3 | 2026-07-17 | TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configurati… |
CVE-2026-63097 | Medium | 4.3 | 2026-07-17 | Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticat… |
CVE-2026-63096 | Medium | 5.8 | 2026-07-17 | Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS con… |
CVE-2026-63095 | Medium | 6.5 | 2026-07-17 | Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete thi… |
CVE-2026-60025 | High | 8.8 | 2026-07-17 | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file… |
CVE-2026-60024 | Critical | 9.8 | 2026-07-17 | Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by de… |
CVE-2026-58149 | Medium | 5.3 | 2026-07-17 | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user… |
CVE-2026-58148 | | 2026-07-17 | Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 - The Joomla extension ChronoForms is vulnerable to an unauth… | |
CVE-2026-15783 | | 2026-07-17 | A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read… | |
CVE-2026-15343 | | 2026-07-17 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater contain… | |
CVE-2026-15007 | | 2026-07-17 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repo… | |
CVE-2026-14871 | | 2026-07-17 | osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-… | |
CVE-2026-14741 | High | 7.5 | 2026-07-17 | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a… |
CVE-2026-12715 | | 2026-07-17 | Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deploye… | |
CVE-2026-63094 | High | 8.1 | 2026-07-17 | SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from… |
CVE-2026-63093 | High | 8.8 | 2026-07-17 | Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malici… |
CVE-2026-51083 | Medium | 6.5 | 2026-07-17 | Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtai… |
CVE-2026-51082 | High | 7.2 | 2026-07-17 | A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-… |
CVE-2026-51081 | Medium | 6.1 | 2026-07-17 | A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to… |
CVE-2026-16089 | Medium | 5.4 | 2026-07-17 | A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound… |
CVE-2026-16017 | Medium | 6.3 | 2026-07-17 | A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron… |
CVE-2026-12705 | Medium | 6.4 | 2026-07-17 | Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update Tool (ABB): through 2… |
CVE-2026-9592 | | 2026-07-17 | SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the sess… | |
CVE-2026-7488 | High | 7.5 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects… |
CVE-2026-51080 | Critical | 9.8 | 2026-07-17 | libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. |
CVE-2026-16072 | Medium | 4.9 | 2026-07-17 | A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitati… |
CVE-2026-16016 | High | 7.3 | 2026-07-17 | A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipula… |
CVE-2026-16015 | Medium | 6.3 | 2026-07-17 | A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/ta… |
CVE-2026-8396 | High | 7.5 | 2026-07-17 | Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects… |
CVE-2026-7189 | High | 7.5 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constraine… |
CVE-2026-16014 | High | 7.3 | 2026-07-17 | A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulat… |
CVE-2026-13410 | High | 8.2 | 2026-07-17 | Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicit… |
CVE-2026-13082 | Medium | 5.3 | 2026-07-17 | GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling c… |
CVE-2026-16013 | Medium | 5.3 | 2026-07-17 | A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760. Affected by this issue is the function CipAppPath::deseria… |
CVE-2026-16009 | Medium | 6.3 | 2026-07-17 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The mani… |
CVE-2026-15943 | Medium | 5.5 | 2026-07-17 | A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrat… |
CVE-2026-9602 | Medium | 6.5 | 2026-07-17 | Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which allows a malicious ser… |
CVE-2026-8075 | Medium | 6.5 | 2026-07-17 | Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App which allows any user… |
CVE-2026-59695 | | 2026-07-17 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by… | |
CVE-2026-59694 | | 2026-07-17 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a… | |
CVE-2026-59252 | | 2026-07-17 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of… | |
CVE-2026-16008 | Medium | 6.3 | 2026-07-17 | A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/key… |
CVE-2026-22104 | | 2026-07-17 | Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracke… |