2026 CVEs (page 159)
Page 159 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55880 | High | 7.1 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predic… |
CVE-2026-55879 | Critical | 9.3 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from… |
CVE-2026-55665 | | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker… | |
CVE-2026-55664 | Medium | 4.3 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying th… |
CVE-2026-55659 | High | 7.7 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into t… |
CVE-2026-55405 | High | 7.6 | 2026-07-10 | LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the Mari… |
CVE-2026-55233 | High | 7.5 | 2026-07-10 | OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 i… |
CVE-2026-55229 | High | 7.5 | 2026-07-10 | Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document… |
CVE-2026-55213 | High | 7.5 | 2026-07-10 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instru… |
CVE-2026-45203 | High | 7.8 | 2026-07-10 | Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of… |
CVE-2026-45196 | High | 7.8 | 2026-07-10 | Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privil… |
CVE-2026-41154 | High | 7.8 | 2026-07-10 | Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB i… |
CVE-2026-34196 | High | 7.8 | 2026-07-10 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the… |
CVE-2026-13039 | Medium | 5.3 | 2026-07-10 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression… |
CVE-2026-12761 | Critical | 9.8 | 2026-07-10 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account ta… |
CVE-2026-57850 | High | 8.3 | 2026-07-10 | RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, Port… |
CVE-2026-57158 | Critical | 9.1 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix fo… |
CVE-2026-57157 | Medium | 6.5 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator c… |
CVE-2026-57156 | Critical | 9.8 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_d… |
CVE-2026-55827 | High | 7.5 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass de… |
CVE-2026-55789 | High | 8.5 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML resp… |
CVE-2026-55515 | Medium | 5.0 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes Checko… |
CVE-2026-55481 | Medium | 4.8 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS styl… |
CVE-2026-55479 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permissi… |
CVE-2026-55475 | Medium | 5.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to… |
CVE-2026-55469 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal s… |
CVE-2026-55466 | High | 8.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and Upload… |
CVE-2026-55462 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and… |
CVE-2026-55461 | Medium | 6.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into… |
CVE-2026-55452 | High | 7.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActiv… |
CVE-2026-55377 | High | 8.1 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verificati… |
CVE-2026-55370 | Medium | 6.4 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOT… |
CVE-2026-54714 | Medium | 6.1 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and action… |
CVE-2026-15295 | Medium | 4.4 | 2026-07-10 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and… |
CVE-2026-11321 | Medium | 6.4 | 2026-07-10 | The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without para… |
CVE-2026-6212 | High | 8.8 | 2026-07-10 | Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege Abuse. This issue affects TeraM… |
CVE-2026-61461 | High | 8.8 | 2026-07-10 | Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying u… |
CVE-2026-61460 | High | 8.8 | 2026-07-10 | Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteControlle… |
CVE-2026-61459 | Critical | 9.8 | 2026-07-10 | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows… |
CVE-2026-5801 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM… |
CVE-2026-59151 | Critical | 9.6 | 2026-07-10 | Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding whi… |
CVE-2026-55843 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermiss… |
CVE-2026-55516 | High | 7.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance… |
CVE-2026-55478 | Medium | 5.4 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not aut… |
CVE-2026-55476 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cance… |
CVE-2026-55474 | Medium | 6.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upl… |
CVE-2026-55472 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location… |
CVE-2026-55464 | Medium | 5.4 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, a… |
CVE-2026-55460 | High | 7.1 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can… |
CVE-2026-54329 | High | 8.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while… |
CVE-2026-53450 | High | 7.4 | 2026-07-10 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is e… |
CVE-2026-53449 | Medium | 6.0 | 2026-07-10 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argume… |
CVE-2026-53448 | High | 7.2 | 2026-07-10 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into S… |
CVE-2026-15146 | Medium | 5.9 | 2026-07-10 | GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that… |
CVE-2026-57476 | Medium | 4.8 | 2026-07-10 | Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject c… |
CVE-2026-57475 | Medium | 5.3 | 2026-07-10 | Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited addit… |
CVE-2026-57474 | Medium | 5.3 | 2026-07-10 | Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This infor… |
CVE-2026-56668 | High | 8.1 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-ex… |
CVE-2026-56667 | High | 7.3 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.def… |
CVE-2026-56666 | Medium | 4.8 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is ver… |
CVE-2026-56665 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 thr… |
CVE-2026-56664 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/provide… |
CVE-2026-55672 | High | 7.4 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flow… |
CVE-2026-55671 | | 2026-07-10 | ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML… | |
CVE-2026-55670 | | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted… | |
CVE-2026-2397 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injec… |
CVE-2026-59193 | Medium | 4.9 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archi… |
CVE-2026-59190 | | 2026-07-10 | grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacke… | |
CVE-2026-59180 | Low | 3.1 | 2026-07-10 | Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, A… |
CVE-2026-59162 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv… |
CVE-2026-59161 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRow… |
CVE-2026-59154 | Medium | 4.3 | 2026-07-10 | Wekan is open source kanban built with Meteor. Prior to 9.64, Wekan has a cross-board authorization bypass in the direct Meteor collection allow rules for Chec… |
CVE-2026-58493 | | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable Y… | |
CVE-2026-58492 | | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL q… | |
CVE-2026-57167 | | 2026-07-10 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON… | |
CVE-2026-56675 | High | 8.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host r… |
CVE-2026-55890 | Medium | 4.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leave… |
CVE-2026-55885 | Medium | 6.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav… |
CVE-2026-55783 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs… | |
CVE-2026-55782 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archiv… | |
CVE-2026-55781 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive… | |
CVE-2026-55780 | | 2026-07-10 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Ar… | |
CVE-2026-55687 | High | 7.5 | 2026-07-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write… |
CVE-2026-55669 | Medium | 4.2 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and… |
CVE-2026-55641 | High | 8.2 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header… |
CVE-2026-55638 | High | 8.6 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before… |
CVE-2026-54919 | High | 7.4 | 2026-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL… |
CVE-2026-54063 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/… |
CVE-2026-53657 | High | 8.2 | 2026-07-10 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbit… |
CVE-2026-53653 | | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image… | |
CVE-2026-51119 | Critical | 9.1 | 2026-07-10 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components |
CVE-2026-3251 | Medium | 6.4 | 2026-07-10 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webremium Istanbul Web Design Mezunum Satiyorum allows St… |
CVE-2026-39903 | High | 7.1 | 2026-07-10 | Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentA… |
CVE-2026-39244 | High | 7.5 | 2026-07-10 | adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buf… |
CVE-2026-2398 | High | 8.8 | 2026-07-10 | Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects Mob… |
CVE-2026-1667 | High | 7.2 | 2026-07-10 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and includi… |
CVE-2026-15377 | Medium | 4.3 | 2026-07-10 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlog… |
CVE-2026-15376 | Medium | 6.3 | 2026-07-10 | A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulat… |
CVE-2026-8609 | Medium | 5.3 | 2026-07-10 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust mem… |
CVE-2026-8595 | Medium | 6.8 | 2026-07-10 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of an… |