2026 CVEs (page 163)
Page 163 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14368 | Medium | 5.4 | 2026-08-31 | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and NUL-termi… |
CVE-2026-14367 | Low | 3.1 | 2026-08-31 | The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a pla… |
CVE-2026-82817 | Medium | 6.3 | 2026-08-31 | A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Admin… |
CVE-2026-82816 | Medium | 6.3 | 2026-08-31 | A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the co… |
CVE-2026-82815 | High | 7.3 | 2026-08-31 | A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulati… |
CVE-2026-82813 | Medium | 5.4 | 2026-08-31 | A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebu… |
CVE-2026-82811 | Medium | 5.4 | 2026-08-31 | A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. Th… |
CVE-2026-79750 | High | 7.7 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79749 | | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… | |
CVE-2026-79748 | Critical | 9.9 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79747 | High | 7.1 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79746 | High | 8.1 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79745 | High | 7.1 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79744 | High | 8.8 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79743 | | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… | |
CVE-2026-51730 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via se… |
CVE-2026-51729 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion of a managed slave… |
CVE-2026-51728 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload a crafted firmware… |
CVE-2026-51727 | Medium | 5.3 | 2026-08-31 | Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve administrative import… |
CVE-2026-51726 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove parental-control rule… |
CVE-2026-51725 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via s… |
CVE-2026-19953 | Medium | 6.5 | 2026-08-31 | URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each ho… |
CVE-2026-82810 | Low | 3.3 | 2026-08-31 | A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExte… |
CVE-2026-82809 | Medium | 4.3 | 2026-08-31 | A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of th… |
CVE-2026-82808 | High | 7.3 | 2026-08-31 | A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker… |
CVE-2026-51724 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smart QoS rules via sen… |
CVE-2026-51723 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install a custom CGI modul… |
CVE-2026-51722 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint the device to an a… |
CVE-2026-51721 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via s… |
CVE-2026-51720 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter r… |
CVE-2026-17615 | High | 7.5 | 2026-08-31 | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending… |
CVE-2026-14366 | Medium | 6.4 | 2026-08-31 | The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it does not own. In the Z… |
CVE-2026-83492 | | 2026-08-31 | Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1. | |
CVE-2026-82807 | High | 8.8 | 2026-08-31 | A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kern… |
CVE-2026-82805 | Medium | 4.3 | 2026-08-31 | A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of… |
CVE-2026-82803 | Medium | 5.3 | 2026-08-31 | A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_string_ELEMENT in the library struct2json/inc/s2jdef.h of th… |
CVE-2026-82802 | Medium | 5.3 | 2026-08-31 | A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearc… |
CVE-2026-77975 | Medium | 6.5 | 2026-08-31 | The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. An unauthenticated… |
CVE-2026-77966 | High | 8.8 | 2026-08-31 | The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker coul… |
CVE-2026-76133 | Critical | 9.8 | 2026-08-31 | The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or… |
CVE-2026-75133 | High | 7.5 | 2026-08-31 | Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a… |
CVE-2026-75132 | Medium | 6.5 | 2026-08-31 | WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote au… |
CVE-2026-73819 | Critical | 9.8 | 2026-08-31 | The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain… |
CVE-2026-51719 | High | 7.5 | 2026-08-31 | Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules… |
CVE-2026-51718 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reserva… |
CVE-2026-51717 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode… |
CVE-2026-51716 | High | 7.5 | 2026-08-31 | Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding ru… |
CVE-2026-51715 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via… |
CVE-2026-51714 | Medium | 5.9 | 2026-08-31 | Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roaming behavior via send… |
CVE-2026-51713 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state vi… |
CVE-2026-51712 | Medium | 5.9 | 2026-08-31 | Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless availability w… |
CVE-2026-51711 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing windo… |
CVE-2026-51710 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behav… |
CVE-2026-51709 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi set… |
CVE-2026-51708 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sen… |
CVE-2026-51706 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade traffic handling via s… |
CVE-2026-51705 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sendi… |
CVE-2026-51704 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter mesh configurations v… |
CVE-2026-51703 | Medium | 5.4 | 2026-08-31 | Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter when Wi-Fi is availa… |
CVE-2026-51702 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter firewall policies… |
CVE-2026-51701 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access contro… |
CVE-2026-51700 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior… |
CVE-2026-51699 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending… |
CVE-2026-51698 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via… |
CVE-2026-51153 | Medium | 5.4 | 2026-08-31 | Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run… |
CVE-2026-51152 | Critical | 9.1 | 2026-08-31 | Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclie… |
CVE-2026-21827 | Low | 3.1 | 2026-08-31 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2026-82970 | Critical | 10.0 | 2026-08-31 | Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files… |
CVE-2026-82801 | High | 7.3 | 2026-08-31 | A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/ha… |
CVE-2026-82703 | Medium | 6.6 | 2026-08-31 | A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPi… |
CVE-2026-82702 | Medium | 6.6 | 2026-08-31 | A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such… |
CVE-2026-82701 | High | 7.3 | 2026-08-31 | A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the… |
CVE-2026-78422 | | 2026-08-31 | Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas… | |
CVE-2026-66047 | High | 8.1 | 2026-08-31 | ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attack… |
CVE-2026-59111 | Critical | 9.3 | 2026-08-31 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Iden… |
CVE-2026-51697 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration v… |
CVE-2026-51696 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services… |
CVE-2026-51695 | High | 7.5 | 2026-08-31 | Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sendin… |
CVE-2026-51694 | High | 7.5 | 2026-08-31 | Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP… |
CVE-2026-51693 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sendi… |
CVE-2026-51692 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wir… |
CVE-2026-51691 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or fla… |
CVE-2026-51690 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and con… |
CVE-2026-51689 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflo… |
CVE-2026-51688 | High | 7.5 | 2026-08-31 | Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cau… |
CVE-2026-51687 | Critical | 9.1 | 2026-08-31 | Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wir… |
CVE-2026-51686 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireles… |
CVE-2026-51684 | Critical | 9.8 | 2026-08-31 | Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related servi… |
CVE-2026-51683 | Medium | 4.3 | 2026-08-31 | Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter LAN network configuration via… |
CVE-2026-82700 | Medium | 4.3 | 2026-08-31 | A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php o… |
CVE-2026-82699 | Low | 2.7 | 2026-08-31 | A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.s… |
CVE-2026-82698 | Medium | 5.3 | 2026-08-31 | A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown function of the fil… |
CVE-2026-82697 | Low | 3.7 | 2026-08-31 | A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the f… |
CVE-2026-82217 | High | 8.8 | 2026-08-31 | In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replaceme… |
CVE-2026-78079 | | 2026-08-31 | Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64… | |
CVE-2026-78078 | | 2026-08-31 | Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only fil… | |
CVE-2026-78077 | | 2026-08-31 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized col… | |
CVE-2026-78076 | | 2026-08-31 | Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-mega… | |
CVE-2026-78075 | | 2026-08-31 | Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whethe… | |
CVE-2026-78074 | | 2026-08-31 | Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allo… |