2026 CVEs (page 158)
Page 158 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73751 | High | 8.8 | 2026-09-01 | An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the und… |
CVE-2026-73750 | High | 8.8 | 2026-09-01 | Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit the… |
CVE-2026-73749 | Critical | 9.8 | 2026-09-01 | Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploi… |
CVE-2026-73524 | Medium | 6.1 | 2026-09-01 | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by em… |
CVE-2026-71981 | High | 8.8 | 2026-09-01 | Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplyi… |
CVE-2026-63435 | Medium | 5.3 | 2026-09-01 | Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilit… |
CVE-2026-84309 | Medium | 5.5 | 2026-09-01 | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_st… |
CVE-2026-84308 | Medium | 6.3 | 2026-09-01 | phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php per… |
CVE-2026-84307 | Low | 3.7 | 2026-09-01 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login… |
CVE-2026-78608 | Medium | 6.5 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an in… |
CVE-2026-78607 | Medium | 5.4 | 2026-09-01 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holdin… |
CVE-2026-78606 | Medium | 4.2 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Co… |
CVE-2026-78605 | Medium | 5.9 | 2026-09-01 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smugglin… |
CVE-2026-78603 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-78597 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constr… |
CVE-2026-78592 | High | 7.3 | 2026-09-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources… |
CVE-2026-76658 | Critical | 10.0 | 2026-09-01 | A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrat… |
CVE-2026-76657 | Critical | 10.0 | 2026-09-01 | Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent… |
CVE-2026-73748 | Low | 2.2 | 2026-09-01 | A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information i… |
CVE-2026-73747 | Low | 2.5 | 2026-09-01 | A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low priv… |
CVE-2026-73746 | Low | 3.1 | 2026-09-01 | A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a… |
CVE-2026-73745 | Low | 3.1 | 2026-09-01 | A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the af… |
CVE-2026-73744 | Low | 3.5 | 2026-09-01 | A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privileg… |
CVE-2026-73743 | Low | 3.7 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into som… |
CVE-2026-73742 | Medium | 4.3 | 2026-09-01 | A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attri… |
CVE-2026-73741 | Medium | 4.3 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exp… |
CVE-2026-73740 | Medium | 4.4 | 2026-09-01 | A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate the… |
CVE-2026-73739 | Medium | 4.4 | 2026-09-01 | A vulnerability exists in the API of HPE Networking Fabric Composer that allows for an attacker with administrative privileges to access sensitive information… |
CVE-2026-73738 | Medium | 4.7 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73737 | Medium | 4.8 | 2026-09-01 | An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenti… |
CVE-2026-73736 | Medium | 5.3 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system file… |
CVE-2026-73735 | Medium | 5.4 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their p… |
CVE-2026-73734 | Medium | 5.4 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an… |
CVE-2026-73733 | Medium | 5.4 | 2026-09-01 | Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentica… |
CVE-2026-73732 | Medium | 5.6 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73731 | Medium | 6.1 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected c… |
CVE-2026-73730 | Medium | 6.5 | 2026-09-01 | A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege op… |
CVE-2026-73729 | Medium | 6.5 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access… |
CVE-2026-73728 | Medium | 6.5 | 2026-09-01 | Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a d… |
CVE-2026-73727 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A succes… |
CVE-2026-73726 | Medium | 6.8 | 2026-09-01 | A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjace… |
CVE-2026-73725 | High | 7.0 | 2026-09-01 | A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a l… |
CVE-2026-73724 | High | 7.1 | 2026-09-01 | Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege ope… |
CVE-2026-73723 | High | 7.1 | 2026-09-01 | A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an aut… |
CVE-2026-73722 | High | 7.2 | 2026-09-01 | Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perfo… |
CVE-2026-73721 | High | 7.2 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Netw… |
CVE-2026-73720 | High | 7.2 | 2026-09-01 | Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful… |
CVE-2026-73719 | High | 7.2 | 2026-09-01 | An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate priv… |
CVE-2026-73718 | High | 7.4 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive info… |
CVE-2026-73717 | High | 7.5 | 2026-09-01 | A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote att… |
CVE-2026-73716 | High | 7.5 | 2026-09-01 | A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote at… |
CVE-2026-73715 | High | 7.5 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful e… |
CVE-2026-73714 | High | 7.6 | 2026-09-01 | A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low… |
CVE-2026-73713 | High | 7.8 | 2026-09-01 | Local privilege-escalation vulnerabilities have been discovered in HPE Networking Fabric Composer. Successful exploitation of these vulnerabilities could allow… |
CVE-2026-73712 | High | 8.1 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if… |
CVE-2026-73711 | High | 8.1 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remot… |
CVE-2026-73710 | High | 8.2 | 2026-09-01 | Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Succ… |
CVE-2026-73709 | High | 8.3 | 2026-09-01 | A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands… |
CVE-2026-73708 | High | 8.3 | 2026-09-01 | A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator… |
CVE-2026-73707 | High | 8.5 | 2026-09-01 | Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege ope… |
CVE-2026-73706 | High | 8.6 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change… |
CVE-2026-73705 | High | 8.8 | 2026-09-01 | An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privile… |
CVE-2026-73704 | High | 8.8 | 2026-09-01 | A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator… |
CVE-2026-73703 | High | 8.8 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cr… |
CVE-2026-73702 | High | 8.8 | 2026-09-01 | A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege op… |
CVE-2026-73701 | Critical | 9.0 | 2026-09-01 | An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if ce… |
CVE-2026-73700 | Critical | 9.0 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a s… |
CVE-2026-72682 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-72654 | Medium | 6.5 | 2026-09-01 | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An o… |
CVE-2026-72652 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-72649 | High | 8.8 | 2026-09-01 | Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)… |
CVE-2026-72644 | Medium | 6.5 | 2026-09-01 | Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-priv… |
CVE-2026-72641 | Medium | 5.4 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… |
CVE-2026-72633 | Medium | 4.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by… |
CVE-2026-72628 | Medium | 6.5 | 2026-09-01 | Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user hol… |
CVE-2026-63138 | Medium | 6.5 | 2026-09-01 | Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An auth… |
CVE-2026-63137 | High | 8.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-56143 | Medium | 4.9 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-45221 | High | 7.8 | 2026-09-01 | Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-cont… |
CVE-2026-33465 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-19766 | Critical | 9.6 | 2026-09-01 | An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unau… |
CVE-2026-8712 | High | 8.3 | 2026-09-01 | Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connecti… |
CVE-2026-84306 | Medium | 6.5 | 2026-09-01 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/… |
CVE-2026-84305 | | 2026-09-01 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controll… | |
CVE-2026-84304 | | 2026-09-01 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recv… | |
CVE-2026-84303 | | 2026-09-01 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header… | |
CVE-2026-83551 | High | 7.2 | 2026-09-01 | Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 mig… |
CVE-2026-81846 | Low | 3.5 | 2026-09-01 | An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypa… |
CVE-2026-52295 | Low | 2.9 | 2026-09-01 | FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c. |
CVE-2026-52132 | High | 7.5 | 2026-09-01 | llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) vi… |
CVE-2026-52131 | High | 7.5 | 2026-09-01 | llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function. |
CVE-2026-52130 | High | 7.5 | 2026-09-01 | llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service. |
CVE-2026-52111 | Critical | 9.8 | 2026-09-01 | An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey |
CVE-2026-52023 | High | 7.5 | 2026-09-01 | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_p… |
CVE-2026-52022 | High | 7.5 | 2026-09-01 | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components |
CVE-2026-51974 | High | 8.8 | 2026-09-01 | An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to exe… |
CVE-2026-19593 | Critical | 9.8 | 2026-09-01 | OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contai… |
CVE-2026-19592 | High | 7.3 | 2026-09-01 | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the re… |
CVE-2026-19591 | High | 8.8 | 2026-09-01 | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-… |
CVE-2026-19590 | High | 7.3 | 2026-09-01 | OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hoo… |