2026 CVEs (page 147)
Page 147 of 666 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85662 | Medium | 5.3 | 2026-09-04 | Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to ar… |
CVE-2026-85661 | Critical | 9.8 | 2026-09-04 | excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. At… |
CVE-2026-85660 | High | 8.1 | 2026-09-04 | cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled… |
CVE-2026-85651 | High | 8.5 | 2026-09-04 | Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs in… |
CVE-2026-85650 | Medium | 5.4 | 2026-09-04 | Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSR… |
CVE-2026-85626 | High | 7.5 | 2026-09-04 | git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-… |
CVE-2026-85625 | High | 8.1 | 2026-09-04 | sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. Th… |
CVE-2026-85624 | Medium | 6.5 | 2026-09-04 | Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied… |
CVE-2026-85623 | High | 8.8 | 2026-09-04 | goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes… |
CVE-2026-85622 | Medium | 5.3 | 2026-09-04 | AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowin… |
CVE-2026-85621 | Medium | 6.5 | 2026-09-04 | LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhook… |
CVE-2026-85620 | High | 8.6 | 2026-09-04 | Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. At… |
CVE-2026-85619 | High | 7.5 | 2026-09-04 | AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and… |
CVE-2026-85618 | Medium | 6.5 | 2026-09-04 | ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files w… |
CVE-2026-85608 | High | 7.5 | 2026-09-04 | Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that al… |
CVE-2026-85607 | High | 8.8 | 2026-09-04 | Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfte… |
CVE-2026-85606 | High | 7.5 | 2026-09-04 | firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments witho… |
CVE-2026-85605 | Medium | 5.3 | 2026-09-04 | Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/imag… |
CVE-2026-82729 | | 2026-09-04 | Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of servic… | |
CVE-2026-82728 | | 2026-09-04 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cau… | |
CVE-2026-81859 | Medium | 6.2 | 2026-09-04 | CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm. |
CVE-2026-81832 | High | 7.7 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is… |
CVE-2026-6958 | High | 7.8 | 2026-09-04 | Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-pr… |
CVE-2026-19727 | Medium | 6.1 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and El… |
CVE-2026-19205 | High | 7.5 | 2026-09-04 | Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: befo… |
CVE-2026-14466 | Medium | 4.3 | 2026-09-04 | It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions… |
CVE-2026-85522 | Medium | 5.3 | 2026-09-04 | A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_… |
CVE-2026-85517 | Medium | 5.3 | 2026-09-04 | A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_management.sql of the co… |
CVE-2026-77818 | Medium | 6.1 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and El… |
CVE-2026-52691 | High | 8.8 | 2026-09-04 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metas… |
CVE-2026-19081 | Medium | 4.3 | 2026-09-04 | Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This… |
CVE-2026-19057 | Medium | 5.4 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows… |
CVE-2026-12483 | High | 7.5 | 2026-09-04 | The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input… |
CVE-2026-85649 | High | 7.9 | 2026-09-04 | (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops… |
CVE-2026-85516 | High | 7.3 | 2026-09-04 | A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performin… |
CVE-2026-85514 | Medium | 6.3 | 2026-09-04 | A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of t… |
CVE-2026-85513 | Medium | 6.3 | 2026-09-04 | A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file… |
CVE-2026-82309 | Medium | 4.3 | 2026-09-04 | Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not b… |
CVE-2026-74237 | Medium | 6.5 | 2026-09-04 | GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function con… |
CVE-2026-74236 | Medium | 6.5 | 2026-09-04 | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function a… |
CVE-2026-74235 | Medium | 4.9 | 2026-09-04 | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_downl… |
CVE-2026-18198 | High | 8.8 | 2026-09-04 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Services Internal and External Trade Inc… |
CVE-2026-85617 | High | 8.8 | 2026-09-04 | snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users… |
CVE-2026-85616 | High | 8.5 | 2026-09-04 | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enable… |
CVE-2026-85615 | Medium | 6.4 | 2026-09-04 | Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to… |
CVE-2026-85614 | High | 8.6 | 2026-09-04 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully clien… |
CVE-2026-85613 | High | 8.2 | 2026-09-04 | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attacke… |
CVE-2026-85612 | High | 7.5 | 2026-09-04 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacke… |
CVE-2026-85611 | Medium | 6.4 | 2026-09-04 | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures… |
CVE-2026-85610 | High | 8.8 | 2026-09-04 | OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code… |
CVE-2026-85609 | High | 7.5 | 2026-09-04 | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api… |
CVE-2026-85604 | High | 8.8 | 2026-09-04 | Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension… |
CVE-2026-85603 | Medium | 6.5 | 2026-09-04 | Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An… |
CVE-2026-85602 | Medium | 5.3 | 2026-09-04 | The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key… |
CVE-2026-85601 | Medium | 5.4 | 2026-09-04 | Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and Mar… |
CVE-2026-85600 | Medium | 5.4 | 2026-09-04 | Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.sve… |
CVE-2026-85599 | High | 7.2 | 2026-09-04 | Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are wri… |
CVE-2026-85598 | Medium | 6.4 | 2026-09-04 | Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payl… |
CVE-2026-85597 | Critical | 9.1 | 2026-09-04 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass clien… |
CVE-2026-85596 | Critical | 9.8 | 2026-09-04 | Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress ca… |
CVE-2026-85595 | Critical | 9.8 | 2026-09-04 | Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown… |
CVE-2026-85594 | Critical | 9.8 | 2026-09-04 | Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation i… |
CVE-2026-85593 | Medium | 5.4 | 2026-09-04 | phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on s… |
CVE-2026-85592 | Low | 3.7 | 2026-09-04 | phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants acces… |
CVE-2026-85591 | | 2026-09-04 | phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to cha… | |
CVE-2026-85590 | | 2026-09-04 | phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig(… | |
CVE-2026-85589 | | 2026-09-04 | phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only… | |
CVE-2026-85588 | | 2026-09-04 | phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extra… | |
CVE-2026-85587 | | 2026-09-04 | phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attac… | |
CVE-2026-85586 | | 2026-09-04 | phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can… | |
CVE-2026-85585 | High | 7.5 | 2026-09-04 | SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique… |
CVE-2026-85584 | High | 7.5 | 2026-09-04 | SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attac… |
CVE-2026-85583 | Medium | 6.5 | 2026-09-04 | SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized… |
CVE-2026-85582 | Medium | 6.5 | 2026-09-04 | SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers… |
CVE-2026-85581 | High | 7.5 | 2026-09-04 | SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled… |
CVE-2026-85580 | Medium | 6.5 | 2026-09-04 | SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems… |
CVE-2026-85579 | Medium | 4.3 | 2026-09-04 | SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState… |
CVE-2026-85578 | Medium | 6.5 | 2026-09-04 | SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks expl… |
CVE-2026-85577 | Medium | 5.4 | 2026-09-04 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitr… |
CVE-2026-19080 | High | 7.5 | 2026-09-04 | Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 2… |
CVE-2026-19051 | High | 7.1 | 2026-09-04 | Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Port… |
CVE-2026-19043 | Medium | 4.3 | 2026-09-04 | Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affect… |
CVE-2026-18957 | Medium | 5.4 | 2026-09-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. … |
CVE-2026-85534 | Medium | 5.9 | 2026-09-04 | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flo… |
CVE-2026-85512 | High | 7.3 | 2026-09-04 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session… |
CVE-2026-84428 | High | 7.5 | 2026-09-04 | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it… |
CVE-2026-84045 | Medium | 5.3 | 2026-09-04 | The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the serv… |
CVE-2026-79707 | | 2026-09-04 | A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenti… | |
CVE-2026-4644 | | 2026-09-04 | A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an… | |
CVE-2026-27347 | Medium | 5.3 | 2026-09-04 | Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopu… |
CVE-2026-85547 | | 2026-09-04 | A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request… | |
CVE-2026-85546 | | 2026-09-04 | MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServ… | |
CVE-2026-85541 | Medium | 5.4 | 2026-09-04 | DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in… |
CVE-2026-85540 | High | 8.8 | 2026-09-04 | DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and dele… |
CVE-2026-85184 | Critical | 9.1 | 2026-09-04 | @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify r… |
CVE-2026-84504 | High | 8.1 | 2026-09-04 | fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. I… |
CVE-2026-84469 | High | 7.5 | 2026-09-04 | fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as… |
CVE-2026-84044 | Medium | 5.3 | 2026-09-04 | The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allow… |
CVE-2026-84043 | Medium | 5.3 | 2026-09-04 | The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing u… |
CVE-2026-82923 | Critical | 9.8 | 2026-09-04 | The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated… |