2026 CVEs (page 150)
Page 150 of 666 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77465 | High | 7.5 | 2026-09-03 | toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js who… |
CVE-2026-71429 | Medium | 6.2 | 2026-09-03 | stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignor… |
CVE-2026-63376 | High | 8.2 | 2026-09-03 | toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__… |
CVE-2026-85207 | Low | 3.5 | 2026-09-03 | A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such… |
CVE-2026-85053 | High | 8.8 | 2026-09-03 | Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a… |
CVE-2026-85052 | Low | 3.1 | 2026-09-03 | Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory… |
CVE-2026-85051 | High | 8.8 | 2026-09-03 | Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
CVE-2026-85050 | Critical | 9.6 | 2026-09-03 | Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via… |
CVE-2026-85049 | High | 8.8 | 2026-09-03 | Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-85048 | High | 8.3 | 2026-09-03 | Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary c… |
CVE-2026-85047 | Critical | 9.6 | 2026-09-03 | Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary… |
CVE-2026-85046 | High | 8.8 | 2026-09-03 | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-85045 | High | 7.5 | 2026-09-03 | Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-85044 | Medium | 6.5 | 2026-09-03 | Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web… |
CVE-2026-85043 | Critical | 9.1 | 2026-09-03 | Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffi… |
CVE-2026-85042 | Critical | 9.6 | 2026-09-03 | Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML p… |
CVE-2026-82527 | High | 7.5 | 2026-09-03 | R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipul… |
CVE-2026-53728 | High | 7.1 | 2026-09-03 | Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/exter… |
CVE-2026-44506 | High | 8.2 | 2026-09-03 | Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could retu… |
CVE-2026-19795 | Medium | 6.2 | 2026-09-03 | Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can tr… |
CVE-2026-85396 | High | 7.5 | 2026-09-03 | rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix compar… |
CVE-2026-85395 | High | 7.1 | 2026-09-03 | UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks… |
CVE-2026-85394 | Critical | 9.1 | 2026-09-03 | python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefi… |
CVE-2026-85393 | High | 7.5 | 2026-09-03 | node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed… |
CVE-2026-85392 | Medium | 4.3 | 2026-09-03 | Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to… |
CVE-2026-85391 | Critical | 9.8 | 2026-09-03 | Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any ac… |
CVE-2026-85390 | High | 7.1 | 2026-09-03 | Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to… |
CVE-2026-85389 | Medium | 6.5 | 2026-09-03 | Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another t… |
CVE-2026-85388 | High | 8.1 | 2026-09-03 | Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitra… |
CVE-2026-85205 | Medium | 6.3 | 2026-09-03 | A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controlle… |
CVE-2026-85028 | High | 7.8 | 2026-09-03 | Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga)… |
CVE-2026-82526 | Critical | 9.8 | 2026-09-03 | R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the… |
CVE-2026-82302 | High | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-82299 | Medium | 6.5 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
CVE-2026-82298 | Medium | 4.3 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
CVE-2026-78596 | Medium | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification… |
CVE-2026-78595 | Medium | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclos… |
CVE-2026-78593 | Medium | 4.3 | 2026-09-03 | An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject… |
CVE-2026-78583 | High | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarati… |
CVE-2026-49456 | Low | 3.1 | 2026-09-03 | Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/d… |
CVE-2026-49455 | Medium | 6.5 | 2026-09-03 | Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origi… |
CVE-2026-33630 | High | 7.5 | 2026-09-03 | c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw —… |
CVE-2026-15431 | | 2026-09-03 | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could pote… | |
CVE-2026-85187 | High | 7.3 | 2026-09-03 | A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the fi… |
CVE-2026-85012 | High | 8.0 | 2026-09-03 | Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprint… |
CVE-2026-84968 | Medium | 5.3 | 2026-09-03 | An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a… |
CVE-2026-83959 | High | 7.8 | 2026-09-03 | Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-82024 | Medium | 5.4 | 2026-09-03 | LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to i… |
CVE-2026-82023 | Medium | 4.3 | 2026-09-03 | LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor rol… |
CVE-2026-63219 | High | 8.6 | 2026-09-03 | GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatte… |
CVE-2026-58400 | Critical | 9.1 | 2026-09-03 | GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render form… |
CVE-2026-85309 | Medium | 5.3 | 2026-09-03 | Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issu… |
CVE-2026-85308 | Medium | 5.3 | 2026-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-85307 | Medium | 5.3 | 2026-09-03 | Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP… |
CVE-2026-85306 | Medium | 6.5 | 2026-09-03 | Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-85305 | Medium | 5.4 | 2026-09-03 | Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1. |
CVE-2026-85304 | Medium | 5.3 | 2026-09-03 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Conf… |
CVE-2026-85303 | Medium | 6.5 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored… |
CVE-2026-85302 | Medium | 6.5 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allo… |
CVE-2026-85242 | | 2026-09-03 | PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the a… | |
CVE-2026-85186 | Medium | 6.3 | 2026-09-03 | A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /c… |
CVE-2026-84849 | Medium | 6.5 | 2026-09-03 | Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions. |
CVE-2026-84848 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. |
CVE-2026-84847 | High | 7.5 | 2026-09-03 | Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. |
CVE-2026-84836 | High | 7.1 | 2026-09-03 | Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. |
CVE-2026-84834 | Critical | 9.8 | 2026-09-03 | Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions. |
CVE-2026-84814 | Critical | 9.8 | 2026-09-03 | Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. |
CVE-2026-84813 | Critical | 9.3 | 2026-09-03 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. |
CVE-2026-84812 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. |
CVE-2026-84779 | High | 8.1 | 2026-09-03 | Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. |
CVE-2026-84778 | High | 7.5 | 2026-09-03 | Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions. |
CVE-2026-84777 | High | 7.4 | 2026-09-03 | Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. |
CVE-2026-84776 | High | 7.5 | 2026-09-03 | Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. |
CVE-2026-84774 | Medium | 6.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions. |
CVE-2026-84773 | High | 7.2 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions. |
CVE-2026-84769 | Medium | 6.5 | 2026-09-03 | Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions. |
CVE-2026-84768 | Critical | 9.3 | 2026-09-03 | Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions. |
CVE-2026-84767 | Medium | 5.3 | 2026-09-03 | Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. |
CVE-2026-84766 | Medium | 5.9 | 2026-09-03 | Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. |
CVE-2026-84765 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. |
CVE-2026-84763 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. |
CVE-2026-84762 | Medium | 5.3 | 2026-09-03 | Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. |
CVE-2026-84761 | High | 7.2 | 2026-09-03 | Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions. |
CVE-2026-84758 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. |
CVE-2026-84757 | High | 8.2 | 2026-09-03 | Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. |
CVE-2026-84756 | High | 7.1 | 2026-09-03 | Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. |
CVE-2026-84755 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. |
CVE-2026-84754 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. |
CVE-2026-84753 | Critical | 9.8 | 2026-09-03 | Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. |
CVE-2026-84752 | High | 8.8 | 2026-09-03 | Contributor PHP Object Injection in RTMKit <= 2.1.5 versions. |
CVE-2026-84736 | | 2026-09-03 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate va… | |
CVE-2026-84238 | Critical | 9.8 | 2026-09-03 | Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. |
CVE-2026-84215 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. |
CVE-2026-81776 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. |
CVE-2026-81773 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. |
CVE-2026-81300 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions. |
CVE-2026-81295 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions. |
CVE-2026-81292 | High | 7.1 | 2026-09-03 | Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. |
CVE-2026-81282 | Medium | 6.5 | 2026-09-03 | Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. |
CVE-2026-81281 | Medium | 6.5 | 2026-09-03 | Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. |