2026 CVEs (page 15)
Page 15 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16878 | Medium | 5.4 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16871 | Medium | 4.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow. |
CVE-2026-16868 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing. |
CVE-2026-16867 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authenticati… |
CVE-2026-16861 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
CVE-2026-16859 | Medium | 5.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16853 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. |
CVE-2026-16815 | High | 8.6 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffe… |
CVE-2026-16722 | High | 8.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management. |
CVE-2026-16713 | Medium | 4.3 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguratio… |
CVE-2026-16692 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow. |
CVE-2026-16674 | High | 8.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path. |
CVE-2026-14875 | High | 7.3 | 2026-08-13 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writea… |
CVE-2026-14525 | Critical | 9.4 | 2026-08-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when th… |
CVE-2026-13460 | High | 7.5 | 2026-08-13 | IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster… |
CVE-2026-13365 | High | 7.1 | 2026-08-13 | IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actio… |
CVE-2026-10571 | Medium | 5.7 | 2026-08-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, a… |
CVE-2026-73653 | Critical | 9.4 | 2026-08-13 | Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreensh… |
CVE-2026-73652 | | 2026-08-13 | vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership… | |
CVE-2026-73651 | Medium | 5.7 | 2026-08-13 | TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to vers… |
CVE-2026-73650 | High | 8.2 | 2026-08-13 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and… |
CVE-2026-73482 | High | 8.1 | 2026-08-13 | phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered v… |
CVE-2026-73481 | Medium | 5.4 | 2026-08-13 | phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is perform… |
CVE-2026-73038 | Medium | 6.1 | 2026-08-13 | NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes… |
CVE-2026-73037 | Medium | 6.1 | 2026-08-13 | Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping i… |
CVE-2026-72777 | High | 8.6 | 2026-08-13 | Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only ch… |
CVE-2026-18071 | High | 7.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management. |
CVE-2026-17220 | High | 8.2 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow. |
CVE-2026-17197 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity. |
CVE-2026-73649 | Critical | 9.8 | 2026-08-13 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __p… |
CVE-2026-73648 | | 2026-08-13 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG ref… | |
CVE-2026-73647 | Medium | 5.6 | 2026-08-13 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/exten… |
CVE-2026-73645 | | 2026-08-13 | OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked conf… | |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-73643 | High | 7.5 | 2026-08-13 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load(… |
CVE-2026-73569 | | 2026-08-13 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser… | |
CVE-2026-73568 | High | 7.5 | 2026-08-13 | py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/ya… |
CVE-2026-73567 | Critical | 9.1 | 2026-08-13 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKe… |
CVE-2026-73566 | High | 7.5 | 2026-08-13 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an… |
CVE-2026-73565 | Medium | 5.3 | 2026-08-13 | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a miss… |
CVE-2026-73564 | | 2026-08-13 | frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to… | |
CVE-2026-73563 | Medium | 4.7 | 2026-08-13 | Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document fe… |
CVE-2026-73562 | Medium | 6.5 | 2026-08-13 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-control… |
CVE-2026-73561 | High | 7.5 | 2026-08-13 | Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConn… |
CVE-2026-72741 | High | 8.1 | 2026-08-13 | Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized ent… |
CVE-2026-67614 | Critical | 9.8 | 2026-08-13 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to f… |
CVE-2026-67613 | Medium | 4.9 | 2026-08-13 | CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by… |
CVE-2026-19730 | Medium | 4.2 | 2026-08-13 | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy atte… |
CVE-2026-18428 | High | 8.8 | 2026-08-13 | A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to… |
CVE-2026-12236 | Medium | 6.5 | 2026-08-13 | The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote G… |
CVE-2026-73266 | High | 7.1 | 2026-08-13 | A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating… |
CVE-2026-59765 | High | 7.5 | 2026-08-13 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata |
CVE-2026-59763 | Medium | 4.3 | 2026-08-13 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
CVE-2026-59109 | High | 8.8 | 2026-08-13 | SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-inv… |
CVE-2026-58511 | Low | 2.7 | 2026-08-13 | Webhook Authorization Header Returned in Plaintext via API |
CVE-2026-58510 | Medium | 4.3 | 2026-08-13 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
CVE-2026-58508 | Critical | 9.1 | 2026-08-13 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
CVE-2026-58507 | Medium | 5.3 | 2026-08-13 | Private Repository Existence Disclosure via go-get Meta Endpoint |
CVE-2026-58445 | Low | 2.7 | 2026-08-13 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
CVE-2026-58444 | Medium | 4.3 | 2026-08-13 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents |
CVE-2026-58443 | Critical | 9.1 | 2026-08-13 | Public-only repository tokens can update private PR head branches |
CVE-2026-58442 | Medium | 6.5 | 2026-08-13 | Repository migration SSRF via multi-answer DNS allow-list bypass |
CVE-2026-58441 | Medium | 6.3 | 2026-08-13 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL |
CVE-2026-58440 | Medium | 6.8 | 2026-08-13 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocati… |
CVE-2026-58439 | High | 8.1 | 2026-08-13 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag |
CVE-2026-58438 | High | 7.5 | 2026-08-13 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access |
CVE-2026-58437 | High | 7.1 | 2026-08-13 | Repository Visibility Manipulation via Git Push Options |
CVE-2026-58436 | High | 7.5 | 2026-08-13 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests |
CVE-2026-58435 | Medium | 5.4 | 2026-08-13 | Gitea LFS Deploy-Key Privilege Escalation |
CVE-2026-58434 | High | 7.5 | 2026-08-13 | Private Repository Metadata Remains Accessible After Access Revocation |
CVE-2026-58433 | Critical | 9.1 | 2026-08-13 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
CVE-2026-58432 | Medium | 5.9 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive… |
CVE-2026-58431 | Medium | 4.3 | 2026-08-13 | Public-only API token restriction is not enforced on team API routes |
CVE-2026-58429 | Medium | 4.9 | 2026-08-13 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
CVE-2026-58428 | Medium | 6.5 | 2026-08-13 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) |
CVE-2026-58427 | High | 7.5 | 2026-08-13 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
CVE-2026-58425 | Medium | 4.3 | 2026-08-13 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) |
CVE-2026-58420 | Medium | 4.4 | 2026-08-13 | Local File Inclusion via file:// URI in Migration Restore |
CVE-2026-58417 | High | 7.5 | 2026-08-13 | REST API exposes organization membership of private organizations to public |
CVE-2026-58416 | High | 7.1 | 2026-08-13 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) |
CVE-2026-58314 | High | 7.7 | 2026-08-13 | Two SSRF findings in Gitea 1.26.2 |
CVE-2026-57897 | Medium | 6.5 | 2026-08-13 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs |
CVE-2026-57894 | High | 8.5 | 2026-08-13 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration |
CVE-2026-57886 | Medium | 5.9 | 2026-08-13 | Cross-repository issue/comment attachment re-linking can expose private attachment content |
CVE-2026-56755 | Medium | 6.2 | 2026-08-13 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
CVE-2026-56750 | Critical | 9.1 | 2026-08-13 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
CVE-2026-56657 | Medium | 6.2 | 2026-08-13 | Gitea SSH Key Parser Denial of Service |
CVE-2026-56654 | Critical | 9.8 | 2026-08-13 | Privilege Escalation via Access Token Scope Escalation in API |
CVE-2026-56443 | Critical | 9.6 | 2026-08-13 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 |
CVE-2026-55987 | High | 8.1 | 2026-08-13 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) |
CVE-2026-55986 | Medium | 5.4 | 2026-08-13 | Email Management API Bypasses ManageCredentials Feature Restrictions |
CVE-2026-55984 | Low | 2.7 | 2026-08-13 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
CVE-2026-55982 | Critical | 9.1 | 2026-08-13 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
CVE-2026-55402 | | 2026-08-13 | CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send sp… | |
CVE-2026-54481 | High | 7.5 | 2026-08-13 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) |
CVE-2026-50105 | Medium | 4.3 | 2026-08-13 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
CVE-2026-42931 | Medium | 6.5 | 2026-08-13 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint |
CVE-2026-24791 | High | 8.1 | 2026-08-13 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes |
CVE-2026-24059 | Medium | 6.5 | 2026-08-13 | The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if n… |
CVE-2026-23603 | Low | 3.1 | 2026-08-13 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim |