2026 CVEs (page 152)
Page 152 of 667 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85214 | High | 8.1 | 2026-09-03 | vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID… |
CVE-2026-85213 | High | 7.6 | 2026-09-03 | Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfR… |
CVE-2026-85212 | High | 8.3 | 2026-09-03 | CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Su… |
CVE-2026-85211 | High | 7.7 | 2026-09-03 | Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenan… |
CVE-2026-85210 | Medium | 4.3 | 2026-09-03 | Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts… |
CVE-2026-85199 | | 2026-09-03 | Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, up… | |
CVE-2026-85183 | Critical | 9.3 | 2026-09-03 | Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connecti… |
CVE-2026-85182 | High | 7.5 | 2026-09-03 | vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change… |
CVE-2026-85181 | Critical | 9.8 | 2026-09-03 | CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline… |
CVE-2026-85180 | High | 7.5 | 2026-09-03 | Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hos… |
CVE-2026-85179 | High | 8.5 | 2026-09-03 | Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses… |
CVE-2026-85178 | High | 7.7 | 2026-09-03 | Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization… |
CVE-2026-85177 | Medium | 5.4 | 2026-09-03 | CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbi… |
CVE-2026-85176 | High | 8.8 | 2026-09-03 | DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resoluti… |
CVE-2026-85135 | Medium | 6.3 | 2026-09-03 | A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file… |
CVE-2026-84989 | High | 7.1 | 2026-09-03 | ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge featur… |
CVE-2026-84971 | Medium | 6.5 | 2026-09-03 | Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the… |
CVE-2026-84970 | Medium | 6.2 | 2026-09-03 | A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding a… |
CVE-2026-84969 | Low | 3.7 | 2026-09-03 | A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a b… |
CVE-2026-75033 | High | 7.7 | 2026-09-03 | A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifyi… |
CVE-2026-71404 | High | 8.7 | 2026-09-03 | A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name`… |
CVE-2026-71403 | Medium | 6.1 | 2026-09-03 | A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user h… |
CVE-2026-63694 | Medium | 5.0 | 2026-09-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vu… |
CVE-2026-56128 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the des… |
CVE-2026-56127 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr p… |
CVE-2026-56126 | Medium | 5.4 | 2026-09-03 | pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configur… |
CVE-2026-35160 | Medium | 5.0 | 2026-09-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injecti… |
CVE-2026-85110 | High | 8.8 | 2026-09-03 | A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Serv… |
CVE-2026-85109 | Critical | 9.8 | 2026-09-03 | A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Serve… |
CVE-2026-84815 | Medium | 5.8 | 2026-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects E… |
CVE-2026-82180 | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.50… | |
CVE-2026-80515 | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its ch… | |
CVE-2026-6071 | | 2026-09-03 | A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an al… | |
CVE-2026-9854 | High | 7.8 | 2026-09-03 | A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the… |
CVE-2026-9853 | High | 7.8 | 2026-09-03 | A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify applicati… |
CVE-2026-9852 | High | 7.8 | 2026-09-03 | A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in so… |
CVE-2026-85175 | High | 8.8 | 2026-09-03 | SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks… |
CVE-2026-85174 | High | 8.8 | 2026-09-03 | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Auth… |
CVE-2026-85173 | Medium | 4.3 | 2026-09-03 | n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights s… |
CVE-2026-85172 | Medium | 6.4 | 2026-09-03 | n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The va… |
CVE-2026-85171 | Medium | 6.5 | 2026-09-03 | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decry… |
CVE-2026-85170 | Medium | 6.5 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string… |
CVE-2026-85169 | High | 8.8 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder na… |
CVE-2026-85168 | High | 8.8 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing… |
CVE-2026-85167 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Qu… |
CVE-2026-85166 | Medium | 6.5 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e… |
CVE-2026-85165 | Critical | 9.9 | 2026-09-03 | n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension p… |
CVE-2026-85164 | High | 7.1 | 2026-09-03 | WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profile… |
CVE-2026-85163 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary i… |
CVE-2026-85162 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidT… |
CVE-2026-85161 | Medium | 4.3 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken chec… |
CVE-2026-85160 | High | 8.1 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete director… |
CVE-2026-85159 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href att… |
CVE-2026-85158 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comme… |
CVE-2026-85157 | Medium | 5.3 | 2026-09-03 | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a prog… |
CVE-2026-85156 | Medium | 5.3 | 2026-09-03 | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted vide… |
CVE-2026-85155 | High | 7.5 | 2026-09-03 | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated… |
CVE-2026-85154 | Critical | 9.8 | 2026-09-03 | WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full… |
CVE-2026-85150 | High | 7.5 | 2026-09-03 | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate head… |
CVE-2026-85124 | High | 7.5 | 2026-09-03 | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured… |
CVE-2026-85107 | Medium | 4.3 | 2026-09-03 | A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/… |
CVE-2026-85106 | Medium | 6.3 | 2026-09-03 | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.t… |
CVE-2026-85105 | High | 7.3 | 2026-09-03 | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Mana… |
CVE-2026-85100 | Medium | 4.3 | 2026-09-03 | A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squ… |
CVE-2026-85093 | Medium | 6.5 | 2026-09-03 | Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticat… |
CVE-2026-85092 | Medium | 6.6 | 2026-09-03 | LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing… |
CVE-2026-85091 | High | 7.4 | 2026-09-03 | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations… |
CVE-2026-85090 | Medium | 5.4 | 2026-09-03 | FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A ma… |
CVE-2026-85089 | Medium | 6.5 | 2026-09-03 | FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in… |
CVE-2026-85084 | Medium | 6.3 | 2026-09-03 | Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers. |
CVE-2026-85040 | Medium | 4.7 | 2026-09-03 | A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/sav… |
CVE-2026-85031 | Critical | 9.9 | 2026-09-03 | A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of t… |
CVE-2026-85030 | Low | 3.7 | 2026-09-03 | A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file servi… |
CVE-2026-85022 | Low | 3.5 | 2026-09-03 | A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webap… |
CVE-2026-85021 | Medium | 4.3 | 2026-09-03 | A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of th… |
CVE-2026-84832 | | 2026-09-03 | SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker… | |
CVE-2026-84831 | | 2026-09-03 | SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker… | |
CVE-2026-84830 | | 2026-09-03 | SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevat… | |
CVE-2026-82918 | Medium | 5.5 | 2026-09-03 | XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially craft… |
CVE-2026-80757 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common security_get_permissi… | |
CVE-2026-80756 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_write_load() calls seli… | |
CVE-2026-80755 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count perm_read() bound… | |
CVE-2026-80754 | High | 7.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detect… |
CVE-2026-80753 | High | 8.4 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose… |
CVE-2026-80752 | High | 8.4 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() retrieves the control… |
CVE-2026-80751 | High | 7.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() r… |
CVE-2026-80750 | High | 8.4 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_lega… |
CVE-2026-80749 | High | 7.1 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given a… |
CVE-2026-80748 | High | 7.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_da… |
CVE-2026-80747 | High | 8.0 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the s… |
CVE-2026-80746 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK Eliza EVK (e… | |
CVE-2026-80745 | High | 8.4 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEG_table[] mapping does… |
CVE-2026-80744 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path In nft_flow_… | |
CVE-2026-80743 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers The irq handlers take a st… | |
CVE-2026-80742 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't send zero-byte data in tpacket_snd(). syzbot reported a WARNING in __dev… | |
CVE-2026-80741 | High | 7.1 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() access… |
CVE-2026-80740 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough… | |
CVE-2026-80739 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock In case __mlx5e_add_fdb… | |
CVE-2026-80738 | High | 7.3 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and b… |
CVE-2026-80737 | High | 7.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for… |