2026 CVEs (page 16)
Page 16 of 659 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93330 | Medium | 4.3 | 2026-09-29 | Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions… |
CVE-2026-92371 | High | 7.0 | 2026-09-29 | TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functiona… |
CVE-2026-92370 | High | 8.8 | 2026-09-29 | An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated rem… |
CVE-2026-92369 | High | 7.3 | 2026-09-29 | TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged a… |
CVE-2026-92368 | High | 7.8 | 2026-09-29 | TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session re… |
CVE-2026-84784 | High | 7.5 | 2026-09-29 | Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the re… |
CVE-2026-84783 | High | 7.5 | 2026-09-29 | Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread i… |
CVE-2026-84782 | High | 8.2 | 2026-09-29 | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message… |
CVE-2026-77696 | Low | 3.7 | 2026-09-29 | Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to… |
CVE-2026-77177 | Critical | 9.8 | 2026-09-29 | Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with… |
CVE-2026-75806 | Medium | 5.3 | 2026-09-29 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment i… |
CVE-2026-75805 | Medium | 5.3 | 2026-09-29 | Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when pro… |
CVE-2026-75804 | Medium | 5.3 | 2026-09-29 | Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the s… |
CVE-2026-72897 | High | 7.5 | 2026-09-29 | Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond th… |
CVE-2026-54875 | Low | 3.7 | 2026-09-29 | Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms… |
CVE-2026-54873 | High | 7.5 | 2026-09-29 | Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnera… |
CVE-2026-54872 | Low | 3.7 | 2026-09-29 | Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementa… |
CVE-2026-42772 | Medium | 5.3 | 2026-09-29 | Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic… |
CVE-2026-35191 | Low | 3.7 | 2026-09-29 | Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvali… |
CVE-2026-35189 | Medium | 5.3 | 2026-09-29 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions… |
CVE-2026-19743 | High | 7.8 | 2026-09-29 | Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authent… |
CVE-2026-102630 | Medium | 4.7 | 2026-09-29 | UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticat… |
CVE-2026-102601 | Low | 3.5 | 2026-09-29 | Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Fil… |
CVE-2026-102600 | High | 7.5 | 2026-09-29 | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties wh… |
CVE-2026-102598 | | 2026-09-29 | Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device pa… | |
CVE-2026-100308 | High | 7.8 | 2026-09-29 | Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary o… |
CVE-2026-100289 | Medium | 5.0 | 2026-09-29 | Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generat… |
CVE-2026-100288 | High | 7.2 | 2026-09-29 | Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to… |
CVE-2026-100287 | Medium | 5.4 | 2026-09-29 | Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently del… |
CVE-2026-100286 | Medium | 6.5 | 2026-09-29 | Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose… |
CVE-2026-86035 | High | 8.5 | 2026-09-29 | Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vu… |
CVE-2026-68911 | | 2026-09-29 | Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages… | |
CVE-2026-65102 | High | 7.8 | 2026-09-29 | NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration fi… |
CVE-2026-63209 | High | 7.5 | 2026-09-29 | compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass… |
CVE-2026-49243 | | 2026-09-29 | Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are… | |
CVE-2026-22101 | | 2026-09-29 | The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addre… | |
CVE-2026-22094 | | 2026-09-29 | The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the networ… | |
CVE-2026-102570 | Medium | 5.5 | 2026-09-29 | ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is con… |
CVE-2026-102569 | Medium | 5.5 | 2026-09-29 | ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concat… |
CVE-2026-102568 | Medium | 5.5 | 2026-09-29 | Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable par… |
CVE-2026-102567 | Medium | 6.1 | 2026-09-29 | CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators… |
CVE-2026-102566 | High | 7.8 | 2026-09-29 | CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size… |
CVE-2026-102491 | High | 7.3 | 2026-09-29 | A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFi… |
CVE-2026-102371 | | 2026-09-29 | In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the… | |
CVE-2026-97395 | High | 8.1 | 2026-09-29 | Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint… |
CVE-2026-86450 | High | 7.5 | 2026-09-29 | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Fun… |
CVE-2026-81569 | Medium | 4.3 | 2026-09-29 | An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target pro… |
CVE-2026-78214 | Medium | 5.3 | 2026-09-29 | An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matchin… |
CVE-2026-71899 | Medium | 6.5 | 2026-09-29 | A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the… |
CVE-2026-71898 | Medium | 4.3 | 2026-09-29 | An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance… |
CVE-2026-71897 | Medium | 4.3 | 2026-09-29 | An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows… |
CVE-2026-4034 | | 2026-09-29 | Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based admi… | |
CVE-2026-102521 | High | 8.6 | 2026-09-29 | The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past t… |
CVE-2026-102360 | High | 8.6 | 2026-09-29 | A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read… |
CVE-2026-98164 | | 2026-09-29 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvm_gfn_is_write_tracked() check… | |
CVE-2026-96869 | Medium | 4.3 | 2026-09-29 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… |
CVE-2026-82973 | Critical | 9.4 | 2026-09-29 | Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when be… |
CVE-2026-82804 | High | 8.8 | 2026-09-29 | The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substituti… |
CVE-2026-7193 | | 2026-09-29 | A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gai… | |
CVE-2026-7192 | | 2026-09-29 | A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a… | |
CVE-2026-76875 | Medium | 5.3 | 2026-09-29 | PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attack… |
CVE-2026-76114 | Medium | 5.9 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An un… |
CVE-2026-73599 | Medium | 5.4 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability… |
CVE-2026-73598 | High | 7.8 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability… |
CVE-2026-102437 | High | 7.8 | 2026-09-29 | OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who c… |
CVE-2026-101271 | | 2026-09-29 | OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled. | |
CVE-2026-101270 | | 2026-09-29 | Malicious HTML content could be injected into the help texts of various fields with organizer permissions. | |
CVE-2026-101269 | | 2026-09-29 | The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-base… | |
CVE-2026-101268 | | 2026-09-29 | If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not not… | |
CVE-2026-101267 | | 2026-09-29 | A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information… | |
CVE-2026-100832 | High | 8.8 | 2026-09-29 | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.4… |
CVE-2026-100831 | High | 8.8 | 2026-09-29 | Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Fir… |
CVE-2026-100830 | High | 8.1 | 2026-09-29 | Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100829 | Critical | 9.6 | 2026-09-29 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100828 | Critical | 9.6 | 2026-09-29 | Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100826 | Medium | 6.5 | 2026-09-29 | Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox… |
CVE-2026-100825 | High | 8.8 | 2026-09-29 | Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100824 | High | 8.8 | 2026-09-29 | Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100823 | Medium | 5.4 | 2026-09-29 | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157. |
CVE-2026-100822 | Medium | 5.4 | 2026-09-29 | Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100821 | Medium | 4.7 | 2026-09-29 | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… |
CVE-2026-100820 | High | 8.8 | 2026-09-29 | Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, F… |
CVE-2026-100819 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140… |
CVE-2026-100818 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thun… |
CVE-2026-100817 | Medium | 5.4 | 2026-09-29 | Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100816 | High | 8.1 | 2026-09-29 | Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100815 | High | 8.8 | 2026-09-29 | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox… |
CVE-2026-100814 | High | 8.8 | 2026-09-29 | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, a… |
CVE-2026-100813 | High | 8.8 | 2026-09-29 | Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100812 | Medium | 6.5 | 2026-09-29 | Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100811 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… |
CVE-2026-100810 | Critical | 9.8 | 2026-09-29 | Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100809 | High | 8.1 | 2026-09-29 | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100808 | High | 8.8 | 2026-09-29 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100807 | High | 8.8 | 2026-09-29 | Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… |
CVE-2026-100806 | Medium | 4.3 | 2026-09-29 | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-100805 | High | 7.5 | 2026-09-29 | Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100804 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100803 | High | 8.1 | 2026-09-29 | Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 1… |
CVE-2026-100802 | Medium | 4.3 | 2026-09-29 | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |