2026 CVEs (page 151)
Page 151 of 667 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75602 | Medium | 6.5 | 2026-09-03 | OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool… |
CVE-2026-85239 | Medium | 6.5 | 2026-09-03 | A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the… |
CVE-2026-85238 | Medium | 6.8 | 2026-09-03 | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated throu… |
CVE-2026-85237 | High | 8.1 | 2026-09-03 | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification att… |
CVE-2026-85236 | High | 8.8 | 2026-09-03 | A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible opera… |
CVE-2026-85138 | High | 7.3 | 2026-09-03 | A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipul… |
CVE-2026-85137 | High | 7.3 | 2026-09-03 | A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Col… |
CVE-2026-84967 | Medium | 4.3 | 2026-09-03 | A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a co… |
CVE-2026-84966 | Medium | 5.1 | 2026-09-03 | An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly… |
CVE-2026-84965 | Medium | 5.1 | 2026-09-03 | An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operat… |
CVE-2026-84964 | Medium | 5.9 | 2026-09-03 | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already tr… |
CVE-2026-84963 | Medium | 5.3 | 2026-09-03 | An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently sho… |
CVE-2026-84962 | Medium | 4.2 | 2026-09-03 | An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorize… |
CVE-2026-83961 | High | 7.1 | 2026-09-03 | ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to… |
CVE-2026-82525 | Medium | 5.5 | 2026-09-03 | Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesys… |
CVE-2026-75036 | | 2026-09-03 | A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources… | |
CVE-2026-75035 | High | 7.7 | 2026-09-03 | A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropp… |
CVE-2026-75034 | High | 7.4 | 2026-09-03 | A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-pro… |
CVE-2026-71963 | High | 8.8 | 2026-09-03 | Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS comma… |
CVE-2026-57445 | | 2026-09-03 | Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting me… | |
CVE-2026-55658 | High | 7.7 | 2026-09-03 | Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting me… |
CVE-2026-53924 | | 2026-09-03 | Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting me… | |
CVE-2026-53720 | | 2026-09-03 | pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the ca… | |
CVE-2026-50554 | Medium | 5.3 | 2026-09-03 | Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "dele… |
CVE-2026-48486 | High | 7.5 | 2026-09-03 | Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer… |
CVE-2026-85230 | Medium | 5.4 | 2026-09-03 | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the wid… |
CVE-2026-85227 | Medium | 6.1 | 2026-09-03 | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttri… |
CVE-2026-85226 | Medium | 4.3 | 2026-09-03 | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applyin… |
CVE-2026-85221 | Critical | 9.1 | 2026-09-03 | MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and there… |
CVE-2026-85216 | Critical | 9.8 | 2026-09-03 | MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentia… |
CVE-2026-85214 | High | 8.1 | 2026-09-03 | vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID… |
CVE-2026-85213 | High | 7.6 | 2026-09-03 | Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfR… |
CVE-2026-85212 | High | 8.3 | 2026-09-03 | CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Su… |
CVE-2026-85211 | High | 7.7 | 2026-09-03 | Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenan… |
CVE-2026-85210 | Medium | 4.3 | 2026-09-03 | Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts… |
CVE-2026-85199 | | 2026-09-03 | Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, up… | |
CVE-2026-85183 | Critical | 9.3 | 2026-09-03 | Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connecti… |
CVE-2026-85182 | High | 7.5 | 2026-09-03 | vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change… |
CVE-2026-85181 | Critical | 9.8 | 2026-09-03 | CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline… |
CVE-2026-85180 | High | 7.5 | 2026-09-03 | Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hos… |
CVE-2026-85179 | High | 8.5 | 2026-09-03 | Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses… |
CVE-2026-85178 | High | 7.7 | 2026-09-03 | Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization… |
CVE-2026-85177 | Medium | 5.4 | 2026-09-03 | CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbi… |
CVE-2026-85176 | High | 8.8 | 2026-09-03 | DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resoluti… |
CVE-2026-85135 | Medium | 6.3 | 2026-09-03 | A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file… |
CVE-2026-84989 | High | 7.1 | 2026-09-03 | ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge featur… |
CVE-2026-84971 | Medium | 6.5 | 2026-09-03 | Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the… |
CVE-2026-84970 | Medium | 6.2 | 2026-09-03 | A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding a… |
CVE-2026-84969 | Low | 3.7 | 2026-09-03 | A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a b… |
CVE-2026-75033 | High | 7.7 | 2026-09-03 | A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifyi… |
CVE-2026-71404 | High | 8.7 | 2026-09-03 | A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name`… |
CVE-2026-71403 | Medium | 6.1 | 2026-09-03 | A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user h… |
CVE-2026-63694 | Medium | 5.0 | 2026-09-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vu… |
CVE-2026-56128 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the des… |
CVE-2026-56127 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr p… |
CVE-2026-56126 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configur… |
CVE-2026-35160 | Medium | 5.0 | 2026-09-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injecti… |
CVE-2026-85110 | High | 8.8 | 2026-09-03 | A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Serv… |
CVE-2026-85109 | Critical | 9.8 | 2026-09-03 | A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Serve… |
CVE-2026-84815 | Medium | 5.8 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects E… |
CVE-2026-82180 | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.50… | |
CVE-2026-80515 | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its ch… | |
CVE-2026-6071 | | 2026-09-03 | A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an al… | |
CVE-2026-9854 | High | 7.8 | 2026-09-03 | A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the… |
CVE-2026-9853 | High | 7.8 | 2026-09-03 | A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify applicati… |
CVE-2026-9852 | High | 7.8 | 2026-09-03 | A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in so… |
CVE-2026-85175 | High | 8.8 | 2026-09-03 | SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks… |
CVE-2026-85174 | High | 8.8 | 2026-09-03 | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Auth… |
CVE-2026-85173 | Medium | 4.3 | 2026-09-03 | n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights s… |
CVE-2026-85172 | Medium | 6.4 | 2026-09-03 | n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The va… |
CVE-2026-85171 | Medium | 6.5 | 2026-09-03 | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decry… |
CVE-2026-85170 | Medium | 6.5 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string… |
CVE-2026-85169 | High | 8.8 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder na… |
CVE-2026-85168 | High | 8.8 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing… |
CVE-2026-85167 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Qu… |
CVE-2026-85166 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e… |
CVE-2026-85165 | Critical | 9.9 | 2026-09-03 | n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension p… |
CVE-2026-85164 | High | 7.1 | 2026-09-03 | WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profile… |
CVE-2026-85163 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary i… |
CVE-2026-85162 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidT… |
CVE-2026-85161 | Medium | 4.3 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken chec… |
CVE-2026-85160 | High | 8.1 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete director… |
CVE-2026-85159 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href att… |
CVE-2026-85158 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comme… |
CVE-2026-85157 | Medium | 5.3 | 2026-09-03 | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a prog… |
CVE-2026-85156 | Medium | 5.3 | 2026-09-03 | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted vide… |
CVE-2026-85155 | High | 7.5 | 2026-09-03 | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated… |
CVE-2026-85154 | Critical | 9.8 | 2026-09-03 | WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full… |
CVE-2026-85150 | High | 7.5 | 2026-09-03 | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate head… |
CVE-2026-85124 | High | 7.5 | 2026-09-03 | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured… |
CVE-2026-85107 | Medium | 4.3 | 2026-09-03 | A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/… |
CVE-2026-85106 | Medium | 6.3 | 2026-09-03 | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.t… |
CVE-2026-85105 | High | 7.3 | 2026-09-03 | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Mana… |
CVE-2026-85100 | Medium | 4.3 | 2026-09-03 | A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squ… |
CVE-2026-85093 | Medium | 6.5 | 2026-09-03 | Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticat… |
CVE-2026-85092 | Medium | 6.6 | 2026-09-03 | LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing… |
CVE-2026-85091 | High | 7.4 | 2026-09-03 | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations… |
CVE-2026-85090 | Medium | 5.4 | 2026-09-03 | FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A ma… |
CVE-2026-85089 | Medium | 6.5 | 2026-09-03 | FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in… |
CVE-2026-85084 | Medium | 6.3 | 2026-09-03 | Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers. |