2026 CVEs (page 134)
Page 134 of 463 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20156 | High | 8.1 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal secur… |
CVE-2026-20153 | High | 7.5 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal secur… |
CVE-2026-20150 | High | 8.8 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal secur… |
CVE-2026-20146 | Medium | 5.5 | 2026-07-15 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to per… |
CVE-2026-1563 | Medium | 4.8 | 2026-07-15 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a hig… |
CVE-2026-1562 | Medium | 4.8 | 2026-07-15 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high p… |
CVE-2026-9007 | | 2026-07-15 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Sit… | |
CVE-2026-62843 | Medium | 6.8 | 2026-07-15 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16… |
CVE-2026-62685 | High | 8.1 | 2026-07-15 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File… |
CVE-2026-62683 | Low | 3.1 | 2026-07-15 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File… |
CVE-2026-61828 | | 2026-07-15 | Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module f… | |
CVE-2026-61371 | High | 7.5 | 2026-07-15 | Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The de… |
CVE-2026-60005 | High | 8.2 | 2026-07-15 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured o… |
CVE-2026-55242 | High | 8.8 | 2026-07-15 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can… |
CVE-2026-50148 | Critical | 10.0 | 2026-07-15 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60… |
CVE-2026-50147 | High | 7.6 | 2026-07-15 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can… |
CVE-2026-47164 | High | 7.7 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-u… |
CVE-2026-47160 | Medium | 5.8 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png endpoint used src/http_client.rs checks i… |
CVE-2026-47159 | | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-relate… | |
CVE-2026-47158 | High | 8.3 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter acce… |
CVE-2026-46709 | High | 7.8 | 2026-07-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts in… |
CVE-2026-45806 | High | 7.7 | 2026-07-15 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from front… |
CVE-2026-45805 | High | 8.8 | 2026-07-15 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServe… |
CVE-2026-45150 | | 2026-07-15 | Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fulls… | |
CVE-2026-44986 | Critical | 9.9 | 2026-07-15 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-tea… |
CVE-2026-41580 | Medium | 6.1 | 2026-07-15 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint ren… |
CVE-2026-62294 | | 2026-07-15 | Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and follo… | |
CVE-2026-61836 | High | 8.6 | 2026-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in… |
CVE-2026-61835 | High | 7.7 | 2026-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL featur… |
CVE-2026-61740 | | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset… | |
CVE-2026-61736 | Critical | 9.3 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in… |
CVE-2026-61684 | | 2026-07-15 | FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints under /api/invoke/* authenticate only by ve… | |
CVE-2026-61646 | | 2026-07-15 | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing… | |
CVE-2026-61644 | High | 7.7 | 2026-07-15 | FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates… |
CVE-2026-61613 | | 2026-07-15 | Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed attacker… | |
CVE-2026-60065 | Low | 3.7 | 2026-07-15 | When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers ca… |
CVE-2026-60062 | Medium | 6.4 | 2026-07-15 | The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure director… |
CVE-2026-59762 | High | 7.5 | 2026-07-15 | When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System… |
CVE-2026-56434 | Medium | 6.5 | 2026-07-15 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), prox… |
CVE-2026-55723 | High | 8.3 | 2026-07-15 | When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configurat… |
CVE-2026-54563 | High | 7.1 | 2026-07-15 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as… |
CVE-2026-54562 | Medium | 6.5 | 2026-07-15 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4… |
CVE-2026-54560 | High | 7.6 | 2026-07-15 | Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id… |
CVE-2026-52865 | Medium | 6.5 | 2026-07-15 | When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or… |
CVE-2026-42533 | High | 8.1 | 2026-07-15 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture… |
CVE-2026-33213 | Medium | 6.1 | 2026-07-15 | Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the schem… |
CVE-2026-59838 | Medium | 5.9 | 2026-07-15 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, Forti… |
CVE-2026-43637 | Critical | 9.1 | 2026-07-15 | Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by s… |
CVE-2026-58559 | Medium | 6.5 | 2026-07-15 | DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-58558 | High | 7.8 | 2026-07-15 | Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-58557 | Medium | 4.8 | 2026-07-15 | Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-58556 | Medium | 5.1 | 2026-07-15 | Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-58555 | Medium | 6.6 | 2026-07-15 | Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-58554 | Medium | 6.6 | 2026-07-15 | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-58553 | Medium | 4.0 | 2026-07-15 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-58552 | Medium | 5.1 | 2026-07-15 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-58551 | Medium | 5.1 | 2026-07-15 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-58550 | Medium | 4.0 | 2026-07-15 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-58549 | Medium | 4.0 | 2026-07-15 | Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-46459 | | 2026-07-15 | ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to re… | |
CVE-2026-46458 | | 2026-07-15 | ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthen… | |
CVE-2026-15809 | High | 7.8 | 2026-07-15 | A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting envir… |
CVE-2026-15779 | Medium | 6.1 | 2026-07-15 | A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a… |
CVE-2026-61873 | High | 8.1 | 2026-07-15 | Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversa… |
CVE-2026-61872 | Low | 2.5 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile… |
CVE-2026-61871 | Low | 3.7 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file… |
CVE-2026-61869 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, w… |
CVE-2026-61868 | Low | 3.7 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggerin… |
CVE-2026-61867 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures du… |
CVE-2026-61866 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by prov… |
CVE-2026-61865 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs. |
CVE-2026-61864 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of mem… |
CVE-2026-61863 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resultin… |
CVE-2026-61862 | Low | 2.9 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profi… |
CVE-2026-61860 | Low | 3.7 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and… |
CVE-2026-61859 | Low | 3.3 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks… |
CVE-2026-61464 | Low | 1.8 | 2026-07-15 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window ti… |
CVE-2026-61457 | High | 8.8 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFi… |
CVE-2026-61453 | Medium | 6.1 | 2026-07-15 | Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before… |
CVE-2026-61452 | Medium | 5.3 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a… |
CVE-2026-61451 | Critical | 9.6 | 2026-07-15 | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-pas… |
CVE-2026-61449 | Medium | 6.5 | 2026-07-15 | Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declar… |
CVE-2026-61446 | High | 8.4 | 2026-07-15 | PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py)… |
CVE-2026-61443 | High | 8.1 | 2026-07-15 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validati… |
CVE-2026-61440 | Medium | 6.5 | 2026-07-15 | PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and… |
CVE-2026-61438 | High | 7.3 | 2026-07-15 | PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workf… |
CVE-2026-61436 | High | 8.6 | 2026-07-15 | PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events… |
CVE-2026-61435 | High | 8.2 | 2026-07-15 | PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISON… |
CVE-2026-61433 | High | 7.8 | 2026-07-15 | PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitra… |
CVE-2026-61430 | High | 8.5 | 2026-07-15 | PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them… |
CVE-2026-61427 | High | 7.3 | 2026-07-15 | PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only… |
CVE-2026-60087 | Medium | 6.1 | 2026-07-15 | PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arg… |
CVE-2026-60085 | High | 7.5 | 2026-07-15 | PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, b… |
CVE-2026-59259 | Medium | 6.5 | 2026-07-15 | n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the stati… |
CVE-2026-59254 | | 2026-07-15 | n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credent… | |
CVE-2026-59236 | | 2026-07-15 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM… | |
CVE-2026-58655 | High | 8.8 | 2026-07-15 | The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rende… |
CVE-2026-57996 | High | 8.8 | 2026-07-15 | phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin… |
CVE-2026-56764 | Low | 3.7 | 2026-07-15 | Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timing… |
CVE-2026-56400 | High | 8.3 | 2026-07-15 | open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests t… |