2026 CVEs (page 144)
Page 144 of 666 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53604 | | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real *pki.CAResolve… | |
CVE-2026-53603 | | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_s… | |
CVE-2026-53602 | | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer b… | |
CVE-2026-85781 | High | 8.7 | 2026-09-04 | Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kuberne… |
CVE-2026-85639 | Medium | 5.6 | 2026-09-04 | A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry End… |
CVE-2026-85638 | High | 7.3 | 2026-09-04 | A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes auth… |
CVE-2026-85637 | Medium | 5.3 | 2026-09-04 | A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Ad… |
CVE-2026-81939 | Critical | 9.1 | 2026-09-04 | A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract… |
CVE-2026-80119 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vu… |
CVE-2026-80118 | High | 7.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical… |
CVE-2026-80117 | High | 7.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulne… |
CVE-2026-80116 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulne… |
CVE-2026-80115 | Medium | 6.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and d… |
CVE-2026-80114 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vul… |
CVE-2026-80113 | High | 7.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulne… |
CVE-2026-80112 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control v… |
CVE-2026-78839 | High | 8.1 | 2026-09-04 | An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file. |
CVE-2026-78328 | Critical | 9.1 | 2026-09-04 | A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to esca… |
CVE-2026-78327 | Critical | 9.1 | 2026-09-04 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-… |
CVE-2026-71620 | High | 8.1 | 2026-09-04 | File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file |
CVE-2026-9317 | High | 8.1 | 2026-09-04 | Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaSc… |
CVE-2026-85769 | Medium | 6.5 | 2026-09-04 | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on… |
CVE-2026-85656 | High | 7.8 | 2026-09-04 | An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands… |
CVE-2026-85654 | High | 7.8 | 2026-09-04 | Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a con… |
CVE-2026-85636 | Medium | 5.3 | 2026-09-04 | A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Log… |
CVE-2026-84890 | Medium | 5.9 | 2026-09-04 | undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is… |
CVE-2026-82538 | High | 8.8 | 2026-09-04 | ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTT… |
CVE-2026-80913 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy im… | |
CVE-2026-80912 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes()… | |
CVE-2026-80911 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() If either tplg_ops->d… | |
CVE-2026-80910 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four… | |
CVE-2026-80909 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264… | |
CVE-2026-80908 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potential overflow in DPB… | |
CVE-2026-80907 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of re… | |
CVE-2026-80906 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame In packet_parse_he… | |
CVE-2026-80905 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp()… | |
CVE-2026-80904 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_read() after a failed async decrypt When an async decrypt fai… | |
CVE-2026-80903 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xe_oa_emit_oa_config() releases… | |
CVE-2026-80902 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA… | |
CVE-2026-80901 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ip_vs_in_icmp_v6() is missing checksum validation for… | |
CVE-2026-80900 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Make UMP message size check more robust If message offset was larger than the… | |
CVE-2026-80899 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image… | |
CVE-2026-80898 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: netfs: clear PG_private_2 on copy-to-cache append failure netfs_pgpriv2_copy_to_cache() m… | |
CVE-2026-80897 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator preparation failure netfs_prepare_read_iterat… | |
CVE-2026-80896 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshv_irqfd_deassign mshv_irqfd_deactivate() and the hlist traversal of… | |
CVE-2026-80895 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: mshv: Order pt_vp_array publish against irqfd assertion path mshv_partition_ioctl_create_… | |
CVE-2026-80894 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace iommufd_hwpt_re… | |
CVE-2026-80893 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() copy_hugetlb_page_r… | |
CVE-2026-80892 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressor_lzma.c sizes the module-global Mic… | |
CVE-2026-80891 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV and AISB before pinning guest pages The AIBV holds one bit… | |
CVE-2026-80890 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips c… | |
CVE-2026-80889 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain order, wakeup handling and tx_gen ordering This patch is a fo… | |
CVE-2026-80888 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() re… | |
CVE-2026-80887 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() valid… | |
CVE-2026-73848 | | 2026-09-04 | Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An… | |
CVE-2026-61688 | Medium | 6.5 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API token… |
CVE-2026-61686 | High | 7.5 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unseri… |
CVE-2026-61614 | Medium | 5.9 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter… |
CVE-2026-61608 | Medium | 6.8 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users… |
CVE-2026-57166 | Medium | 5.3 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet… |
CVE-2026-57165 | Medium | 5.3 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet… |
CVE-2026-57164 | Medium | 5.9 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP cl… |
CVE-2026-57163 | Critical | 9.1 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backen… |
CVE-2026-57162 | Critical | 9.1 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media t… |
CVE-2026-57161 | High | 8.2 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing… |
CVE-2026-57160 | Medium | 5.3 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_… |
CVE-2026-57159 | High | 7.5 | 2026-09-04 | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the… |
CVE-2026-53761 | | 2026-09-04 | Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitat… | |
CVE-2026-53760 | Medium | 5.2 | 2026-09-04 | Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation… |
CVE-2026-53758 | | 2026-09-04 | Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which mean… | |
CVE-2026-53757 | | 2026-09-04 | Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() with… | |
CVE-2026-53756 | Medium | 4.9 | 2026-09-04 | Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The… |
CVE-2026-50553 | | 2026-09-04 | Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"… | |
CVE-2026-19534 | High | 7.5 | 2026-09-04 | undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never reques… |
CVE-2026-18540 | Low | 3.7 | 2026-09-04 | undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting th… |
CVE-2026-18149 | Medium | 5.9 | 2026-09-04 | undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length… |
CVE-2026-85152 | High | 7.4 | 2026-09-04 | undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a… |
CVE-2026-85024 | Medium | 5.9 | 2026-09-04 | undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error… |
CVE-2026-85014 | Medium | 5.9 | 2026-09-04 | undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake… |
CVE-2026-85008 | Low | 3.7 | 2026-09-04 | undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from… |
CVE-2026-84961 | High | 7.4 | 2026-09-04 | undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON… |
CVE-2026-84947 | Low | 3.7 | 2026-09-04 | undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maxi… |
CVE-2026-84933 | Medium | 6.5 | 2026-09-04 | undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In… |
CVE-2026-80886 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from us… | |
CVE-2026-80885 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB message handler Fix AFS to cancel its OOB message processi… | |
CVE-2026-80884 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ntb: Store original DMA address for future release The DMA API requires that dma_free_att… | |
CVE-2026-80883 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered … | |
CVE-2026-80882 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOME… | |
CVE-2026-80881 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2_read_blocks() In ocfs2_read_blocks(), caller s… | |
CVE-2026-80880 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implici… | |
CVE-2026-80879 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write A circular locking depen… | |
CVE-2026-80878 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix leak of ungot volume Fix afs_lookup_volume_rcu() so that it doesn't leak a dying… | |
CVE-2026-80877 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix vllist leak Fix a leak of the new vllist in afs_update_cell() in the event that… | |
CVE-2026-80876 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RB_FORCE_8BYTE_ALIGNMENT… | |
CVE-2026-80875 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb… | |
CVE-2026-80874 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide: Describe inline ECC carveouts The DBSC5 DRAM controller pr… | |
CVE-2026-80873 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions kvm_inject_el2_except… | |
CVE-2026-80872 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue… | |
CVE-2026-80871 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove crypto_rng interface Implementing the crypto_rng interface h… | |
CVE-2026-80870 | | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idr_alloc The KFD CRIU restore flow restore… |