2026 CVEs (page 156)
Page 156 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15527 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon… |
CVE-2026-15526 | Low | 3.3 | 2026-07-13 | A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the… |
CVE-2026-15525 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function _validate_urls of the file src/adloop/ads/write.py. Performin… |
CVE-2026-15524 | Low | 3.3 | 2026-07-13 | A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-f… |
CVE-2026-15523 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /Simple… |
CVE-2026-15522 | Medium | 5.3 | 2026-07-13 | A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js… |
CVE-2026-15521 | Medium | 5.3 | 2026-07-13 | A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component upd… |
CVE-2026-15520 | Medium | 5.3 | 2026-07-13 | A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the compone… |
CVE-2026-15519 | Medium | 5.0 | 2026-07-13 | A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Perfor… |
CVE-2026-15551 | Medium | 5.5 | 2026-07-13 | Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects . |
CVE-2026-15518 | Medium | 4.7 | 2026-07-13 | A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Con… |
CVE-2026-15517 | High | 7.3 | 2026-07-13 | A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulatio… |
CVE-2026-15516 | Medium | 5.6 | 2026-07-13 | A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the com… |
CVE-2026-15515 | High | 7.0 | 2026-07-13 | A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the… |
CVE-2026-15514 | High | 7.3 | 2026-07-13 | A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/x… |
CVE-2026-15513 | Medium | 6.3 | 2026-07-13 | A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a mani… |
CVE-2026-15512 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen… |
CVE-2026-15511 | Critical | 9.8 | 2026-07-12 | A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /us… |
CVE-2026-15510 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper aut… |
CVE-2026-15509 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the… |
CVE-2026-15508 | Medium | 6.3 | 2026-07-12 | A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs o… |
CVE-2026-15507 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy… |
CVE-2026-15506 | High | 7.8 | 2026-07-12 | A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the… |
CVE-2026-15505 | Low | 3.5 | 2026-07-12 | A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component… |
CVE-2026-10668 | Low | 2.4 | 2026-07-12 | The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len i… |
CVE-2026-10667 | High | 7.8 | 2026-07-12 | Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically al… |
CVE-2026-10666 | High | 8.1 | 2026-07-12 | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte st… |
CVE-2026-10665 | High | 7.4 | 2026-07-12 | In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed… |
CVE-2026-10664 | Medium | 5.0 | 2026-07-12 | The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Ti… |
CVE-2026-10663 | Medium | 6.1 | 2026-07-12 | In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object… |
CVE-2026-58596 | High | 8.3 | 2026-07-12 | Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-15502 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Hand… |
CVE-2026-15501 | Medium | 6.3 | 2026-07-12 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the fi… |
CVE-2026-61876 | High | 8.8 | 2026-07-12 | LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Atta… |
CVE-2026-61875 | High | 8.8 | 2026-07-12 | luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOA… |
CVE-2026-61874 | Low | 3.1 | 2026-07-12 | filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stal… |
CVE-2026-59260 | High | 8.8 | 2026-07-12 | OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-… |
CVE-2026-56336 | Medium | 5.3 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id a… |
CVE-2026-56313 | High | 8.1 | 2026-07-12 | Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delet… |
CVE-2026-56308 | High | 7.3 | 2026-07-12 | Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attac… |
CVE-2026-56281 | Low | 3.8 | 2026-07-12 | Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidat… |
CVE-2026-56271 | Critical | 9.8 | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and is… |
CVE-2026-56260 | Critical | 9.1 | 2026-07-12 | Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accep… |
CVE-2026-56259 | High | 8.2 | 2026-07-12 | Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-cont… |
CVE-2026-56252 | Medium | 5.4 | 2026-07-12 | Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook… |
CVE-2026-56241 | High | 8.3 | 2026-07-12 | Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non… |
CVE-2026-56238 | High | 7.5 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to… |
CVE-2026-15500 | Medium | 6.3 | 2026-07-12 | A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashb… |
CVE-2026-15499 | Medium | 6.3 | 2026-07-12 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools… |
CVE-2026-15498 | High | 7.3 | 2026-07-12 | A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users… |
CVE-2026-15497 | High | 7.3 | 2026-07-12 | A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org… |
CVE-2026-15496 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org… |
CVE-2026-15495 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the co… |
CVE-2026-15494 | Medium | 4.7 | 2026-07-12 | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a… |
CVE-2026-15493 | Low | 3.5 | 2026-07-12 | A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing… |
CVE-2026-15492 | Medium | 4.3 | 2026-07-12 | A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulnerability affects unknown code of the fi… |
CVE-2026-15491 | High | 7.3 | 2026-07-12 | A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation caus… |
CVE-2026-15490 | High | 7.3 | 2026-07-12 | A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown function… |
CVE-2026-15489 | High | 7.3 | 2026-07-12 | A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functio… |
CVE-2026-15488 | High | 7.3 | 2026-07-12 | A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileContr… |
CVE-2026-15487 | Medium | 6.3 | 2026-07-12 | A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts the function sub_41FBD0 of the file /goform/system_ntp of the component Firmware Update… |
CVE-2026-15486 | Medium | 6.3 | 2026-07-12 | A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This affects the function sub_42026C of the file /goform/tools_ddns of the component Firmware Up… |
CVE-2026-15485 | Medium | 6.3 | 2026-07-12 | A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/tools_nslookup of the component DNS L… |
CVE-2026-15484 | High | 8.8 | 2026-07-12 | A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function sub_41EC14 of the file /goform/tools_nslookup of the componen… |
CVE-2026-15483 | High | 8.8 | 2026-07-12 | A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function sub_41EC14 of the file /goform/tools_nslookup of the compon… |
CVE-2026-15482 | High | 7.3 | 2026-07-12 | A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consulta… |
CVE-2026-15481 | High | 8.8 | 2026-07-12 | A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the compone… |
CVE-2026-15480 | High | 8.8 | 2026-07-12 | A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. S… |
CVE-2026-15479 | High | 7.3 | 2026-07-12 | A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Adm… |
CVE-2026-15478 | Medium | 6.3 | 2026-07-12 | A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the co… |
CVE-2026-15477 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the… |
CVE-2026-15476 | Medium | 5.3 | 2026-07-12 | A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the compon… |
CVE-2026-15475 | Medium | 5.3 | 2026-07-12 | A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the library pwdrvio.sys of the component… |
CVE-2026-15474 | Medium | 4.3 | 2026-07-12 | A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Ca… |
CVE-2026-15473 | Medium | 6.3 | 2026-07-12 | A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of… |
CVE-2026-15472 | Medium | 4.3 | 2026-07-12 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Exe… |
CVE-2026-15471 | Medium | 4.3 | 2026-07-12 | A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulat… |
CVE-2026-15470 | Medium | 4.3 | 2026-07-12 | A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Su… |
CVE-2026-58281 | High | 8.3 | 2026-07-11 | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-10660 | Medium | 6.4 | 2026-07-11 | The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a si… |
CVE-2026-61870 | Low | 2.9 | 2026-07-11 | ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by… |
CVE-2026-61861 | Low | 3.7 | 2026-07-11 | ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memor… |
CVE-2026-61858 | Low | 3.3 | 2026-07-11 | ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can w… |
CVE-2026-61857 | Low | 3.7 | 2026-07-11 | ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious… |
CVE-2026-61465 | Low | 3.3 | 2026-07-11 | ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker ca… |
CVE-2026-61454 | Medium | 5.3 | 2026-07-11 | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at… |
CVE-2026-61448 | | 2026-07-11 | Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83. When an uploaded file's ext… | |
CVE-2026-61447 | Critical | 10.0 | 2026-07-11 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST valid… |
CVE-2026-61445 | Critical | 9.9 | 2026-07-11 | PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command… |
CVE-2026-61442 | High | 7.1 | 2026-07-11 | PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which onl… |
CVE-2026-61439 | High | 7.5 | 2026-07-11 | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-lev… |
CVE-2026-61429 | High | 8.5 | 2026-07-11 | PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF vali… |
CVE-2026-61428 | High | 7.3 | 2026-07-11 | PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed send… |
CVE-2026-61426 | High | 8.6 | 2026-07-11 | PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated a… |
CVE-2026-60090 | Critical | 9.8 | 2026-07-11 | PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends… |
CVE-2026-60088 | Medium | 5.5 | 2026-07-11 | PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers c… |
CVE-2026-56763 | Medium | 4.8 | 2026-07-11 | Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ pr… |
CVE-2026-56372 | Low | 3.3 | 2026-07-11 | ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrec… |
CVE-2026-56303 | High | 7.5 | 2026-07-11 | Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable b… |
CVE-2026-56296 | Medium | 5.3 | 2026-07-11 | Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existi… |