2026 CVEs (page 137)
Page 137 of 463 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48355 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-48350 | High | 8.6 | 2026-07-14 | Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code exec… |
CVE-2026-48349 | High | 8.1 | 2026-07-14 | Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depen… |
CVE-2026-48348 | High | 7.7 | 2026-07-14 | Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depen… |
CVE-2026-48347 | High | 7.7 | 2026-07-14 | Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitra… |
CVE-2026-48346 | High | 7.9 | 2026-07-14 | Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-48345 | High | 8.2 | 2026-07-14 | Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitra… |
CVE-2026-48310 | High | 8.6 | 2026-07-14 | Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbi… |
CVE-2026-48263 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2026-48262 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48261 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48260 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48259 | Critical | 9.6 | 2026-07-14 | Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2026-48257 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48255 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48254 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48253 | Medium | 5.4 | 2026-07-14 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2026-48252 | High | 8.6 | 2026-07-14 | Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacke… |
CVE-2026-48069 | High | 7.5 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4… |
CVE-2026-48068 | High | 7.5 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4… |
CVE-2026-48038 | Medium | 5.3 | 2026-07-14 | joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception i… |
CVE-2026-48001 | Low | 3.7 | 2026-07-14 | Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on condit… |
CVE-2026-48000 | Medium | 6.1 | 2026-07-14 | Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a… |
CVE-2026-47999 | Medium | 4.8 | 2026-07-14 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts… |
CVE-2026-47998 | Medium | 5.9 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-47997 | Medium | 5.9 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-47996 | Medium | 6.8 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit… |
CVE-2026-47995 | High | 8.1 | 2026-07-14 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts… |
CVE-2026-47994 | High | 8.7 | 2026-07-14 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-47992 | High | 7.2 | 2026-07-14 | Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitr… |
CVE-2026-47988 | High | 8.6 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-47984 | High | 8.2 | 2026-07-14 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-47737 | High | 7.5 | 2026-07-14 | Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_… |
CVE-2026-47736 | High | 7.5 | 2026-07-14 | Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes in… |
CVE-2026-47482 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful… |
CVE-2026-47481 | Medium | 6.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel… |
CVE-2026-47480 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit of this vulnerability… |
CVE-2026-47479 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this v… |
CVE-2026-47478 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of th… |
CVE-2026-47477 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. A successful exploit of this vulne… |
CVE-2026-47476 | High | 7.5 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this v… |
CVE-2026-47429 | Critical | 9.8 | 2026-07-14 | Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vites… |
CVE-2026-47428 | Critical | 9.6 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier quer… |
CVE-2026-47423 | High | 8.2 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to… |
CVE-2026-47212 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doP… |
CVE-2026-45071 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlC… |
CVE-2026-45068 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTranspor… |
CVE-2026-15714 | Medium | 6.5 | 2026-07-14 | An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() fu… |
CVE-2026-15713 | Medium | 5.9 | 2026-07-14 | A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termi… |
CVE-2026-15711 | High | 7.5 | 2026-07-14 | A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which man… |
CVE-2026-15709 | High | 7.5 | 2026-07-14 | A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes da… |
CVE-2026-15410 | High | 7.2 | 2026-07-14 | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AM… |
CVE-2026-15409 | Critical | 10.0 | 2026-07-14 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could p… |
CVE-2026-13001 | Critical | 9.8 | 2026-07-14 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_fil… |
CVE-2026-5040 | Medium | 6.7 | 2026-07-14 | TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or pr… |
CVE-2026-47767 | Critical | 9.8 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE… |
CVE-2026-47305 | High | 7.8 | 2026-07-14 | Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally. |
CVE-2026-47304 | High | 8.1 | 2026-07-14 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-47303 | High | 8.8 | 2026-07-14 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-47302 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-47301 | High | 8.8 | 2026-07-14 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-47300 | High | 8.8 | 2026-07-14 | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-45755 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse()… |
CVE-2026-45754 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridg… |
CVE-2026-45753 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttribu… |
CVE-2026-45305 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45304 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45133 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser… |
CVE-2026-45075 | High | 8.2 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsS… |
CVE-2026-45073 | High | 7.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doCl… |
CVE-2026-45072 | Medium | 5.4 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development… |
CVE-2026-45070 | Medium | 6.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45069 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verify… |
CVE-2026-45064 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitiz… |
CVE-2026-45063 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticato… |
CVE-2026-15720 | High | 8.6 | 2026-07-14 | In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial o… |
CVE-2026-15712 | Medium | 5.9 | 2026-07-14 | A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library proce… |
CVE-2026-15642 | Low | 3.3 | 2026-07-14 | Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an at… |
CVE-2026-15641 | High | 7.1 | 2026-07-14 | Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve… |
CVE-2026-15637 | High | 7.5 | 2026-07-14 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileg… |
CVE-2026-15058 | Low | 3.1 | 2026-07-14 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user'… |
CVE-2026-62659 | | 2026-07-14 | A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unautho… | |
CVE-2026-62658 | | 2026-07-14 | A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized com… | |
CVE-2026-62657 | | 2026-07-14 | A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow… | |
CVE-2026-62656 | | 2026-07-14 | A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized… | |
CVE-2026-62655 | | 2026-07-14 | A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly… | |
CVE-2026-58638 | Medium | 6.0 | 2026-07-14 | Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally. |
CVE-2026-58637 | High | 7.0 | 2026-07-14 | Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-58634 | High | 7.8 | 2026-07-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-58633 | High | 7.8 | 2026-07-14 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-58632 | High | 7.8 | 2026-07-14 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-58629 | High | 7.0 | 2026-07-14 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2026-58628 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to ele… |
CVE-2026-58627 | High | 7.5 | 2026-07-14 | Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2026-58626 | High | 8.8 | 2026-07-14 | Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. |
CVE-2026-58619 | High | 7.0 | 2026-07-14 | Use after free in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-58617 | High | 8.1 | 2026-07-14 | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-58613 | High | 7.8 | 2026-07-14 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-58594 | High | 8.8 | 2026-07-14 | Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network. |
CVE-2026-58547 | Medium | 5.5 | 2026-07-14 | Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally. |