2026 CVEs (page 157)
Page 157 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84334 | High | 8.1 | 2026-09-02 | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sand… |
CVE-2026-84333 | Critical | 9.6 | 2026-09-02 | Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a craf… |
CVE-2026-84332 | Medium | 6.5 | 2026-09-02 | Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HT… |
CVE-2026-84331 | Low | 3.1 | 2026-09-02 | Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-84330 | Medium | 5.4 | 2026-09-02 | UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page… |
CVE-2026-84329 | Medium | 5.3 | 2026-09-02 | Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-84328 | Low | 3.1 | 2026-09-02 | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web or… |
CVE-2026-84327 | Medium | 6.5 | 2026-09-02 | Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sen… |
CVE-2026-84326 | High | 8.8 | 2026-09-02 | Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
CVE-2026-84325 | Critical | 9.8 | 2026-09-02 | Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system acce… |
CVE-2026-84324 | Critical | 9.0 | 2026-09-02 | Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network tra… |
CVE-2026-84323 | Medium | 5.3 | 2026-09-02 | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-81928 | High | 7.5 | 2026-09-02 | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. si… |
CVE-2026-84483 | Medium | 5.3 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid… |
CVE-2026-84482 | High | 8.8 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly… |
CVE-2026-84481 | | 2026-09-01 | WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configur… | |
CVE-2026-84480 | Critical | 9.8 | 2026-09-01 | WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account pas… |
CVE-2026-84479 | Critical | 9.1 | 2026-09-01 | WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncode… |
CVE-2026-84478 | High | 7.3 | 2026-09-01 | WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files… |
CVE-2026-84477 | Medium | 5.4 | 2026-09-01 | AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scrip… |
CVE-2026-84476 | High | 7.5 | 2026-09-01 | WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by en… |
CVE-2026-84423 | High | 7.3 | 2026-09-01 | A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource AP… |
CVE-2026-84208 | High | 7.5 | 2026-09-01 | AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoint… |
CVE-2026-84642 | High | 7.5 | 2026-09-01 | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnam… |
CVE-2026-84641 | High | 7.5 | 2026-09-01 | A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to pr… |
CVE-2026-84640 | High | 7.5 | 2026-09-01 | A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140… |
CVE-2026-84639 | Critical | 9.1 | 2026-09-01 | Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird… |
CVE-2026-84637 | Critical | 9.8 | 2026-09-01 | Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executab… |
CVE-2026-84375 | High | 7.5 | 2026-09-01 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does no… |
CVE-2026-84374 | High | 7.5 | 2026-09-01 | Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy… |
CVE-2026-84373 | Medium | 5.9 | 2026-09-01 | Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in pack… |
CVE-2026-84372 | Critical | 9.8 | 2026-09-01 | Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster a… |
CVE-2026-84289 | Medium | 4.3 | 2026-09-01 | A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the co… |
CVE-2026-84288 | Medium | 4.3 | 2026-09-01 | A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of… |
CVE-2026-83549 | High | 7.8 | 2026-09-01 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000… |
CVE-2026-83548 | Critical | 10.0 | 2026-09-01 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticat… |
CVE-2026-76851 | High | 8.8 | 2026-09-01 | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient… |
CVE-2026-75604 | Critical | 9.0 | 2026-09-01 | Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Rou… |
CVE-2026-19118 | High | 7.5 | 2026-09-01 | A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required a… |
CVE-2026-18730 | High | 7.4 | 2026-09-01 | A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API… |
CVE-2026-84470 | Medium | 6.4 | 2026-09-01 | A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested… |
CVE-2026-84371 | Medium | 5.4 | 2026-09-01 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 unti… |
CVE-2026-84370 | High | 8.2 | 2026-09-01 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and… |
CVE-2026-84369 | Medium | 6.1 | 2026-09-01 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and… |
CVE-2026-84368 | Low | 3.7 | 2026-09-01 | joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the succ… |
CVE-2026-84367 | Low | 3.7 | 2026-09-01 | joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implem… |
CVE-2026-84366 | High | 7.4 | 2026-09-01 | Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler co… |
CVE-2026-84365 | Medium | 6.5 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not c… |
CVE-2026-84364 | Medium | 5.3 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names… |
CVE-2026-84363 | Medium | 5.9 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a liter… |
CVE-2026-84361 | | 2026-09-01 | Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an… | |
CVE-2026-84311 | Low | 3.3 | 2026-09-01 | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and P… |
CVE-2026-84310 | Low | 3.3 | 2026-09-01 | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume… |
CVE-2026-84287 | Medium | 4.3 | 2026-09-01 | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of… |
CVE-2026-73783 | Medium | 4.9 | 2026-09-01 | Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to cause a denial-of-se… |
CVE-2026-73782 | High | 8.8 | 2026-09-01 | A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation… |
CVE-2026-73781 | High | 8.4 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) att… |
CVE-2026-73780 | High | 8.3 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This… |
CVE-2026-73779 | High | 8.2 | 2026-09-01 | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent exis… |
CVE-2026-73778 | High | 8.1 | 2026-09-01 | A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could expl… |
CVE-2026-73777 | High | 8.1 | 2026-09-01 | Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing… |
CVE-2026-73776 | High | 7.9 | 2026-09-01 | A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious ac… |
CVE-2026-73775 | High | 7.7 | 2026-09-01 | Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exp… |
CVE-2026-73774 | High | 7.6 | 2026-09-01 | A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by s… |
CVE-2026-73773 | High | 7.5 | 2026-09-01 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the abi… |
CVE-2026-73772 | Medium | 6.5 | 2026-09-01 | Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of-service condition by sending specially… |
CVE-2026-73771 | High | 7.5 | 2026-09-01 | An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote… |
CVE-2026-73770 | High | 7.3 | 2026-09-01 | An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific cond… |
CVE-2026-73768 | High | 7.3 | 2026-09-01 | A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result… |
CVE-2026-73767 | High | 7.2 | 2026-09-01 | Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the… |
CVE-2026-73766 | High | 7.2 | 2026-09-01 | Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary… |
CVE-2026-73765 | High | 7.2 | 2026-09-01 | Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arb… |
CVE-2026-73764 | High | 7.1 | 2026-09-01 | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent exis… |
CVE-2026-73763 | High | 7.1 | 2026-09-01 | A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation c… |
CVE-2026-73762 | Medium | 6.6 | 2026-09-01 | A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this co… |
CVE-2026-73761 | Medium | 6.5 | 2026-09-01 | An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a… |
CVE-2026-73760 | Medium | 6.5 | 2026-09-01 | An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from t… |
CVE-2026-73759 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets… |
CVE-2026-73758 | Medium | 6.5 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to… |
CVE-2026-73757 | Medium | 6.4 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) at… |
CVE-2026-73756 | Medium | 5.9 | 2026-09-01 | A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Succ… |
CVE-2026-73755 | Medium | 5.7 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, af… |
CVE-2026-73754 | Medium | 5.3 | 2026-09-01 | Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the norma… |
CVE-2026-73753 | High | 8.8 | 2026-09-01 | Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on th… |
CVE-2026-73752 | High | 8.8 | 2026-09-01 | An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to… |
CVE-2026-73751 | High | 8.8 | 2026-09-01 | An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the und… |
CVE-2026-73750 | High | 8.8 | 2026-09-01 | Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit the… |
CVE-2026-73749 | Critical | 9.8 | 2026-09-01 | Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploi… |
CVE-2026-73524 | Medium | 6.1 | 2026-09-01 | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by em… |
CVE-2026-71981 | High | 8.8 | 2026-09-01 | Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplyi… |
CVE-2026-63435 | Medium | 5.3 | 2026-09-01 | Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilit… |
CVE-2026-84309 | Medium | 5.5 | 2026-09-01 | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_st… |
CVE-2026-84308 | Medium | 6.3 | 2026-09-01 | phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php per… |
CVE-2026-84307 | Low | 3.7 | 2026-09-01 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login… |
CVE-2026-78608 | Medium | 6.5 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an in… |
CVE-2026-78607 | Medium | 5.4 | 2026-09-01 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holdin… |
CVE-2026-78606 | Medium | 4.2 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Co… |
CVE-2026-78605 | Medium | 5.9 | 2026-09-01 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smugglin… |
CVE-2026-78603 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-78597 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constr… |