2026 CVEs (page 136)
Page 136 of 463 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49854 | Medium | 5.3 | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mas… |
CVE-2026-49853 | High | 7.7 | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed onl… |
CVE-2026-49477 | High | 7.5 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular express… |
CVE-2026-49476 | High | 7.5 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory… |
CVE-2026-49459 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve e… |
CVE-2026-49458 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-or… |
CVE-2026-48816 | Medium | 6.5 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tl… |
CVE-2026-48815 | High | 7.5 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is… |
CVE-2026-48801 | High | 7.5 | 2026-07-14 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) alg… |
CVE-2026-48758 | Medium | 5.4 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js a… |
CVE-2026-48370 | High | 7.8 | 2026-07-14 | Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48369 | High | 7.8 | 2026-07-14 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48367 | High | 7.8 | 2026-07-14 | After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48366 | High | 7.8 | 2026-07-14 | Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48344 | High | 7.8 | 2026-07-14 | Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-48343 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48342 | High | 7.8 | 2026-07-14 | Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48341 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48340 | High | 7.8 | 2026-07-14 | Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploita… |
CVE-2026-48339 | High | 7.8 | 2026-07-14 | Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48338 | Medium | 6.8 | 2026-07-14 | ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file sys… |
CVE-2026-48332 | High | 7.7 | 2026-07-14 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could le… |
CVE-2026-48329 | Low | 2.7 | 2026-07-14 | ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could lev… |
CVE-2026-48328 | High | 7.7 | 2026-07-14 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage t… |
CVE-2026-48327 | Critical | 9.0 | 2026-07-14 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitati… |
CVE-2026-48325 | Critical | 9.3 | 2026-07-14 | ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-48324 | Critical | 9.1 | 2026-07-14 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary… |
CVE-2026-48322 | Critical | 9.9 | 2026-07-14 | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-48321 | Critical | 9.3 | 2026-07-14 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to… |
CVE-2026-48320 | High | 8.5 | 2026-07-14 | ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a… |
CVE-2026-48319 | Critical | 9.1 | 2026-07-14 | ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code e… |
CVE-2026-48318 | Critical | 9.9 | 2026-07-14 | ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file sys… |
CVE-2026-48311 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48308 | Medium | 5.9 | 2026-07-14 | Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-48284 | Critical | 9.6 | 2026-07-14 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vuln… |
CVE-2026-48274 | High | 7.8 | 2026-07-14 | After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48272 | High | 7.8 | 2026-07-14 | Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the cur… |
CVE-2026-48270 | High | 7.8 | 2026-07-14 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48269 | High | 7.8 | 2026-07-14 | Premiere Pro is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploi… |
CVE-2026-48125 | Medium | 5.3 | 2026-07-14 | UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expressio… |
CVE-2026-47979 | Medium | 5.5 | 2026-07-14 | Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerabili… |
CVE-2026-47976 | High | 7.8 | 2026-07-14 | Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-47971 | High | 7.8 | 2026-07-14 | Media Encoder is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-47475 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread… |
CVE-2026-47473 | High | 7.4 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. A successful exploit of this vulnerability might lead… |
CVE-2026-47472 | High | 7.8 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization… |
CVE-2026-47471 | High | 7.5 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow. A successf… |
CVE-2026-47470 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A suc… |
CVE-2026-46644 | | 2026-07-14 | Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn acc… | |
CVE-2026-24272 | High | 7.8 | 2026-07-14 | NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer. A successful exploit of this vulnerability might lea… |
CVE-2026-24271 | Medium | 6.2 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits o… |
CVE-2026-24268 | High | 7.8 | 2026-07-14 | NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to c… |
CVE-2026-24259 | Medium | 6.4 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of th… |
CVE-2026-24238 | High | 7.8 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index. A successful exploit of this vulnerability mi… |
CVE-2026-24234 | Medium | 6.8 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side… |
CVE-2026-24233 | High | 8.4 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attack… |
CVE-2026-24229 | High | 7.3 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal clu… |
CVE-2026-24227 | Medium | 5.3 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lea… |
CVE-2026-24226 | Medium | 6.3 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerab… |
CVE-2026-24220 | Medium | 6.4 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zer… |
CVE-2026-15778 | Medium | 6.5 | 2026-07-14 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-15777 | High | 7.5 | 2026-07-14 | Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to pote… |
CVE-2026-15776 | High | 8.8 | 2026-07-14 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-15775 | Medium | 6.5 | 2026-07-14 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Ch… |
CVE-2026-15774 | High | 8.3 | 2026-07-14 | Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-15773 | Critical | 9.6 | 2026-07-14 | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-15772 | High | 8.3 | 2026-07-14 | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2026-15771 | Medium | 5.3 | 2026-07-14 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the rende… |
CVE-2026-15770 | Medium | 6.5 | 2026-07-14 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-15769 | High | 8.3 | 2026-07-14 | Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had comprom… |
CVE-2026-15768 | Medium | 6.5 | 2026-07-14 | Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-15767 | High | 8.8 | 2026-07-14 | Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a c… |
CVE-2026-15766 | Medium | 6.5 | 2026-07-14 | Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2026-15765 | High | 7.5 | 2026-07-14 | Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-15764 | High | 7.5 | 2026-07-14 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
CVE-2026-15749 | Medium | 5.3 | 2026-07-14 | A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts… |
CVE-2026-15738 | High | 8.5 | 2026-07-14 | Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote us… |
CVE-2026-15643 | High | 7.3 | 2026-07-14 | AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR da… |
CVE-2026-53633 | Critical | 9.8 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chro… |
CVE-2026-50659 | Medium | 6.5 | 2026-07-14 | Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. |
CVE-2026-50651 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-50650 | High | 7.8 | 2026-07-14 | Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-50649 | High | 7.8 | 2026-07-14 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. |
CVE-2026-50648 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-50646 | High | 7.8 | 2026-07-14 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. |
CVE-2026-50528 | High | 8.2 | 2026-07-14 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-50527 | High | 7.5 | 2026-07-14 | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-50526 | High | 7.0 | 2026-07-14 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. |
CVE-2026-50525 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-50524 | High | 7.5 | 2026-07-14 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-48784 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::do… |
CVE-2026-48761 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSani… |
CVE-2026-48760 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::pa… |
CVE-2026-48747 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSi… |
CVE-2026-48736 | High | 8.6 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNe… |
CVE-2026-48489 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthentic… |
CVE-2026-48371 | Medium | 5.4 | 2026-07-14 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48359 | Critical | 9.6 | 2026-07-14 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code exec… |
CVE-2026-48358 | Critical | 9.1 | 2026-07-14 | Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-48356 | Critical | 9.3 | 2026-07-14 | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of… |