2026 CVEs (page 153)
Page 153 of 667 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-80736 | High | 7.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range fro… |
CVE-2026-80735 | High | 7.3 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF… |
CVE-2026-80734 | High | 8.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes [BUG] When running generic/795 wi… |
CVE-2026-80733 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from sk_mc_loop() sk_mc_loop() can be called for sockets that… | |
CVE-2026-80732 | High | 7.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a reference… |
CVE-2026-80731 | High | 7.8 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads… |
CVE-2026-80730 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERR_PTR to kthread_stop() In test_ringbuffer()'s out_free… | |
CVE-2026-80729 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: initialise workingset state before folio split xas_try_split() adds __GFP… | |
CVE-2026-80728 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devr… | |
CVE-2026-80727 | | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI discovery I hit the following on one of my… | |
CVE-2026-80726 | Critical | 9.3 | 2026-09-03 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly cl… |
CVE-2026-80465 | High | 8.7 | 2026-09-03 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3)… |
CVE-2026-80254 | Medium | 6.5 | 2026-09-03 | Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the… |
CVE-2026-80253 | Medium | 6.8 | 2026-09-03 | An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may execute bootloader… |
CVE-2026-79679 | High | 8.7 | 2026-09-03 | Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services… |
CVE-2026-78080 | | 2026-09-03 | Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing… | |
CVE-2026-78069 | | 2026-09-03 | Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreCont… | |
CVE-2026-78065 | | 2026-09-03 | Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `ed… | |
CVE-2026-78064 | | 2026-09-03 | Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml… | |
CVE-2026-78000 | | 2026-09-03 | Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task ha… | |
CVE-2026-77999 | | 2026-09-03 | Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4… | |
CVE-2026-76642 | High | 7.8 | 2026-09-03 | util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute pr… |
CVE-2026-76178 | | 2026-09-03 | A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with ad… | |
CVE-2026-76177 | | 2026-09-03 | Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_… | |
CVE-2026-76176 | | 2026-09-03 | SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in th… | |
CVE-2026-76175 | | 2026-09-03 | SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with oper… | |
CVE-2026-76174 | | 2026-09-03 | Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based… | |
CVE-2026-74769 | Medium | 6.5 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker… |
CVE-2026-74768 | Medium | 4.1 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remo… |
CVE-2026-73600 | High | 7.8 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remot… |
CVE-2026-71224 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk me… |
CVE-2026-71222 | Medium | 5.3 | 2026-09-03 | A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds vali… |
CVE-2026-71221 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bo… |
CVE-2026-71220 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index with… |
CVE-2026-71219 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the u… |
CVE-2026-68860 | Medium | 6.8 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could p… |
CVE-2026-3852 | Medium | 6.4 | 2026-09-03 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all vers… |
CVE-2026-3416 | Medium | 5.9 | 2026-09-03 | The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This… |
CVE-2026-2573 | Medium | 6.4 | 2026-09-03 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2026-17539 | Medium | 5.9 | 2026-09-03 | RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry o… |
CVE-2026-15933 | | 2026-09-03 | OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service pass… | |
CVE-2026-84888 | Medium | 4.3 | 2026-09-03 | A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/openfang-runtime/src/… |
CVE-2026-84887 | Medium | 4.3 | 2026-09-03 | A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding.py of the componen… |
CVE-2026-84886 | Medium | 5.3 | 2026-09-03 | A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_… |
CVE-2026-84885 | Medium | 4.3 | 2026-09-03 | A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such m… |
CVE-2026-84851 | High | 7.5 | 2026-09-03 | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts th… |
CVE-2026-84394 | High | 7.5 | 2026-09-03 | fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but d… |
CVE-2026-84857 | Medium | 5.3 | 2026-09-02 | A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulatio… |
CVE-2026-84856 | Medium | 5.3 | 2026-09-02 | A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/co… |
CVE-2026-84852 | Medium | 4.4 | 2026-09-02 | A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of… |
CVE-2026-84452 | | 2026-09-02 | Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serv… | |
CVE-2026-84292 | High | 7.5 | 2026-09-02 | fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the por… |
CVE-2026-82524 | High | 7.2 | 2026-09-02 | UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the Tiny… |
CVE-2026-78662 | High | 7.5 | 2026-09-02 | Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, d… |
CVE-2026-75137 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process me… |
CVE-2026-75136 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key store… |
CVE-2026-75135 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vaul… |
CVE-2026-75134 | Medium | 6.4 | 2026-09-02 | SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious… |
CVE-2026-56855 | High | 7.5 | 2026-09-02 | Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RF… |
CVE-2026-84841 | High | 7.3 | 2026-09-02 | A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enfo… |
CVE-2026-84840 | Medium | 6.5 | 2026-09-02 | A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstra… |
CVE-2026-84839 | Medium | 5.3 | 2026-09-02 | A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component… |
CVE-2026-84382 | High | 7.5 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, def… |
CVE-2026-84381 | High | 8.1 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpc… |
CVE-2026-19117 | Critical | 9.8 | 2026-09-02 | Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This i… |
CVE-2026-84833 | Medium | 4.3 | 2026-09-02 | A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of… |
CVE-2026-84380 | Medium | 5.6 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length h… |
CVE-2026-84379 | Medium | 5.3 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attack… |
CVE-2026-84378 | Medium | 5.9 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copie… |
CVE-2026-84377 | Medium | 6.5 | 2026-09-02 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user… |
CVE-2026-82522 | Medium | 5.4 | 2026-09-02 | libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploit… |
CVE-2026-77125 | High | 7.1 | 2026-09-02 | A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended… |
CVE-2026-77124 | High | 7.2 | 2026-09-02 | In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had… |
CVE-2026-77123 | Medium | 6.5 | 2026-09-02 | Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privile… |
CVE-2026-77122 | Medium | 4.3 | 2026-09-02 | An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed a… |
CVE-2026-77121 | Medium | 6.5 | 2026-09-02 | A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes fut… |
CVE-2026-66786 | Critical | 9.1 | 2026-09-02 | A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) with… |
CVE-2026-55221 | Medium | 6.5 | 2026-09-02 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… |
CVE-2026-53706 | | 2026-09-02 | PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and S… | |
CVE-2026-53671 | | 2026-09-02 | PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes… | |
CVE-2026-53670 | | 2026-09-02 | PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::ad… | |
CVE-2026-53649 | Critical | 9.6 | 2026-09-02 | Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication a… |
CVE-2026-49833 | Medium | 5.5 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to bef… |
CVE-2026-49832 | High | 8.0 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-r… |
CVE-2026-49831 | Medium | 5.5 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Cu… |
CVE-2026-49830 | Medium | 4.4 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, when i… |
CVE-2026-49249 | | 2026-09-02 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… | |
CVE-2026-84811 | Medium | 6.5 | 2026-09-02 | agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping ma… |
CVE-2026-84810 | Medium | 6.5 | 2026-09-02 | claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, a… |
CVE-2026-84809 | Medium | 6.5 | 2026-09-02 | Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd ex… |
CVE-2026-84376 | | 2026-09-02 | Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-pref… | |
CVE-2026-82404 | High | 8.3 | 2026-09-02 | TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor… |
CVE-2026-79756 | | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the n… | |
CVE-2026-79755 | High | 8.0 | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespa… |
CVE-2026-79754 | | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline do… | |
CVE-2026-55421 | Medium | 6.8 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url… |
CVE-2026-53636 | Medium | 4.7 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in… |
CVE-2026-53635 | High | 7.6 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms… |
CVE-2026-52833 | High | 8.0 | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file durin… |
CVE-2026-52832 | Medium | 4.9 | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without auth… |