2026 CVEs (page 13)
Page 13 of 659 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-76729 | Medium | 6.6 | 2026-09-29 | A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause m… |
CVE-2026-76728 | High | 7.2 | 2026-09-29 | A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side… |
CVE-2026-76727 | High | 7.2 | 2026-09-29 | Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high priv… |
CVE-2026-76726 | High | 8.1 | 2026-09-29 | An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access… |
CVE-2026-76725 | Critical | 9.6 | 2026-09-29 | A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumve… |
CVE-2026-76724 | Critical | 9.6 | 2026-09-29 | A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform… |
CVE-2026-76723 | Critical | 9.6 | 2026-09-29 | Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achie… |
CVE-2026-76722 | Critical | 9.8 | 2026-09-29 | Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker… |
CVE-2026-76721 | Critical | 9.8 | 2026-09-29 | Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrar… |
CVE-2026-67993 | High | 8.8 | 2026-09-29 | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback. |
CVE-2026-67987 | High | 7.5 | 2026-09-29 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag respons… |
CVE-2026-61519 | High | 8.8 | 2026-09-29 | Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attac… |
CVE-2026-53989 | Medium | 4.7 | 2026-09-29 | Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authent… |
CVE-2026-53988 | Critical | 10.0 | 2026-09-29 | Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arb… |
CVE-2026-39117 | Critical | 9.8 | 2026-09-29 | An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index… |
CVE-2026-102879 | Medium | 5.0 | 2026-09-29 | ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypa… |
CVE-2026-102878 | High | 8.1 | 2026-09-29 | mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers… |
CVE-2026-102877 | Medium | 4.4 | 2026-09-29 | Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth… |
CVE-2026-102876 | High | 8.1 | 2026-09-29 | SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surrea… |
CVE-2026-102875 | High | 7.8 | 2026-09-29 | VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Att… |
CVE-2026-102331 | Critical | 9.6 | 2026-09-29 | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sand… |
CVE-2026-102330 | Medium | 6.5 | 2026-09-29 | Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass w… |
CVE-2026-102329 | Medium | 6.1 | 2026-09-29 | Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafte… |
CVE-2026-102328 | High | 8.8 | 2026-09-29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-102327 | High | 7.5 | 2026-09-29 | Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-102326 | High | 8.8 | 2026-09-29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-102325 | Medium | 4.3 | 2026-09-29 | Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-102324 | High | 8.3 | 2026-09-29 | Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially ex… |
CVE-2026-102323 | High | 8.8 | 2026-09-29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-102321 | High | 8.8 | 2026-09-29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-102320 | Medium | 6.5 | 2026-09-29 | Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin p… |
CVE-2026-102319 | Low | 3.4 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside… |
CVE-2026-102318 | Medium | 4.7 | 2026-09-29 | Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chro… |
CVE-2026-102317 | High | 8.6 | 2026-09-29 | Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outs… |
CVE-2026-102316 | Critical | 9.6 | 2026-09-29 | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the s… |
CVE-2026-102315 | Low | 3.4 | 2026-09-29 | Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to rea… |
CVE-2026-102314 | Medium | 5.4 | 2026-09-29 | UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
CVE-2026-102313 | Medium | 4.7 | 2026-09-29 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafte… |
CVE-2026-102312 | Medium | 4.3 | 2026-09-29 | UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (… |
CVE-2026-102311 | Low | 3.4 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-102310 | Medium | 6.5 | 2026-09-29 | Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web orig… |
CVE-2026-102309 | Critical | 9.6 | 2026-09-29 | Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
CVE-2026-102308 | Critical | 9.6 | 2026-09-29 | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the s… |
CVE-2026-102307 | Medium | 4.7 | 2026-09-29 | Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted… |
CVE-2026-102306 | Critical | 9.6 | 2026-09-29 | Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a c… |
CVE-2026-102305 | Medium | 5.4 | 2026-09-29 | UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chrom… |
CVE-2026-102304 | Critical | 9.6 | 2026-09-29 | Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
CVE-2026-102303 | Medium | 4.3 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML pa… |
CVE-2026-102302 | High | 8.8 | 2026-09-29 | Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
CVE-2026-102301 | High | 8.3 | 2026-09-29 | Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute ar… |
CVE-2026-102300 | Medium | 4.3 | 2026-09-29 | Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-102299 | High | 8.8 | 2026-09-29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-102252 | | 2026-09-29 | A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who con… | |
CVE-2026-100299 | Medium | 6.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption. |
CVE-2026-100298 | High | 8.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are no… |
CVE-2026-100297 | Medium | 5.3 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s inter… |
CVE-2026-100296 | High | 8.1 | 2026-09-29 | In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgr… |
CVE-2026-100295 | Medium | 6.3 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended… |
CVE-2026-100294 | High | 7.5 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaini… |
CVE-2026-100293 | High | 8.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relyi… |
CVE-2026-100292 | High | 8.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to b… |
CVE-2026-100291 | Critical | 9.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This… |
CVE-2026-102831 | High | 8.1 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5… |
CVE-2026-102830 | Medium | 6.8 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5… |
CVE-2026-102829 | | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of… | |
CVE-2026-102828 | | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until… | |
CVE-2026-102827 | High | 8.1 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, t… |
CVE-2026-102826 | High | 8.1 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, t… |
CVE-2026-102825 | Low | 3.7 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs incr… |
CVE-2026-102824 | Medium | 4.3 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all… |
CVE-2026-102823 | High | 7.5 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTEN… |
CVE-2026-102822 | Low | 3.7 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC blo… |
CVE-2026-102821 | Medium | 6.5 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INI… |
CVE-2026-102820 | Medium | 6.2 | 2026-09-29 | pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pag… |
CVE-2026-102616 | High | 7.3 | 2026-09-29 | A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl… |
CVE-2026-95385 | | 2026-09-29 | Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineeri… | |
CVE-2026-95384 | Medium | 5.3 | 2026-09-29 | Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a craft… |
CVE-2026-95382 | Medium | 6.5 | 2026-09-29 | Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged soci… |
CVE-2026-95381 | High | 8.3 | 2026-09-29 | Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-95380 | High | 8.8 | 2026-09-29 | Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code insi… |
CVE-2026-95376 | High | 8.0 | 2026-09-29 | Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system… |
CVE-2026-95375 | Medium | 6.3 | 2026-09-29 | Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web… |
CVE-2026-95374 | Medium | 6.5 | 2026-09-29 | Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-95373 | High | 8.8 | 2026-09-29 | Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the… |
CVE-2026-95372 | High | 8.3 | 2026-09-29 | Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute… |
CVE-2026-95371 | Medium | 5.4 | 2026-09-29 | Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leverag… |
CVE-2026-95370 | Medium | 5.4 | 2026-09-29 | Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML p… |
CVE-2026-95369 | High | 8.8 | 2026-09-29 | Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox… |
CVE-2026-95368 | Medium | 4.3 | 2026-09-29 | Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross… |
CVE-2026-95367 | Medium | 5.3 | 2026-09-29 | Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged socia… |
CVE-2026-95366 | Medium | 6.5 | 2026-09-29 | Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-95365 | High | 8.8 | 2026-09-29 | Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a cr… |
CVE-2026-95364 | Medium | 5.4 | 2026-09-29 | Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromiu… |
CVE-2026-95363 | Medium | 5.4 | 2026-09-29 | UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a c… |
CVE-2026-95362 | High | 8.8 | 2026-09-29 | Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin pol… |
CVE-2026-95361 | Medium | 4.3 | 2026-09-29 | Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a c… |
CVE-2026-95360 | Medium | 5.3 | 2026-09-29 | Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a… |
CVE-2026-95359 | Low | 3.4 | 2026-09-29 | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-95358 | Medium | 4.4 | 2026-09-29 | Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a pr… |
CVE-2026-95357 | Critical | 9.6 | 2026-09-29 | Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sa… |