2026 CVEs (page 165)
Page 165 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82838 | | 2026-08-31 | The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A val… | |
CVE-2026-82631 | Low | 2.2 | 2026-08-31 | A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the… |
CVE-2026-82630 | High | 7.3 | 2026-08-31 | A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob… |
CVE-2026-82629 | Medium | 4.7 | 2026-08-31 | A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affects the function MyJwWebJwid3Controller.d… |
CVE-2026-58301 | Medium | 6.5 | 2026-08-31 | When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connecti… |
CVE-2026-82628 | High | 8.8 | 2026-08-31 | A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component I… |
CVE-2026-82625 | Medium | 4.3 | 2026-08-31 | A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Regis… |
CVE-2026-82624 | Medium | 5.3 | 2026-08-31 | A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of… |
CVE-2026-82623 | Medium | 5.3 | 2026-08-31 | A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/histor… |
CVE-2026-82622 | Low | 3.5 | 2026-08-31 | A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/edita… |
CVE-2026-77013 | Medium | 5.3 | 2026-08-31 | The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check… |
CVE-2026-68951 | Medium | 5.3 | 2026-08-31 | GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookma… |
CVE-2026-58574 | Critical | 9.8 | 2026-08-31 | Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted manage… |
CVE-2026-53620 | Medium | 6.3 | 2026-08-31 | GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an aut… |
CVE-2026-40465 | Medium | 5.3 | 2026-08-31 | NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter. |
CVE-2026-40464 | Medium | 5.4 | 2026-08-31 | NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with… |
CVE-2026-40463 | High | 7.6 | 2026-08-31 | WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated… |
CVE-2026-82621 | High | 7.3 | 2026-08-31 | A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doG… |
CVE-2026-82620 | Medium | 6.3 | 2026-08-31 | A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseD… |
CVE-2026-82619 | Medium | 4.3 | 2026-08-31 | A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitored_item_event_filter_treatment_bs__init_event_filter_… |
CVE-2026-82618 | Medium | 4.3 | 2026-08-31 | A vulnerability was determined in Systerel S2OPC up to 1.7.3. The affected element is the function set_range_matrix_on_string_array of the file src/Common/opcu… |
CVE-2026-82616 | Critical | 9.9 | 2026-08-31 | A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulati… |
CVE-2026-82615 | High | 7.3 | 2026-08-31 | A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordr… |
CVE-2026-82614 | High | 7.3 | 2026-08-31 | A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=prod… |
CVE-2026-82727 | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an excepti… | |
CVE-2026-82726 | | 2026-08-31 | Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request… | |
CVE-2026-82725 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across re… | |
CVE-2026-82724 | | 2026-08-31 | Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access ch… | |
CVE-2026-82613 | High | 7.3 | 2026-08-31 | A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of… |
CVE-2026-82612 | High | 7.3 | 2026-08-31 | A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the fi… |
CVE-2026-82611 | High | 7.3 | 2026-08-31 | A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication… |
CVE-2026-82610 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file… |
CVE-2026-82609 | Medium | 6.3 | 2026-08-31 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit.php. The manipulati… |
CVE-2026-82722 | | 2026-08-31 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM… | |
CVE-2026-82681 | | 2026-08-31 | Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target o… | |
CVE-2026-82673 | | 2026-08-31 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to… | |
CVE-2026-82608 | High | 7.4 | 2026-08-31 | A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of th… |
CVE-2026-82607 | High | 7.3 | 2026-08-31 | A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the f… |
CVE-2026-82605 | Medium | 4.3 | 2026-08-31 | A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such ma… |
CVE-2026-81853 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attrib… | |
CVE-2026-81852 | | 2026-08-31 | Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-… | |
CVE-2026-77850 | | 2026-08-31 | Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The rela… | |
CVE-2026-75757 | | 2026-08-31 | Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind a… | |
CVE-2026-82604 | Medium | 4.3 | 2026-08-31 | A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontr… |
CVE-2026-82603 | Medium | 5.4 | 2026-08-31 | A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Ca… |
CVE-2026-82602 | Medium | 5.3 | 2026-08-31 | A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to author… |
CVE-2026-82601 | Medium | 4.3 | 2026-08-31 | A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lea… |
CVE-2026-82600 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing… |
CVE-2026-82580 | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users. In AshAi.ToolLoo… | |
CVE-2026-82579 | | 2026-08-31 | Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's output to hang the tool… | |
CVE-2026-82564 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy record… | |
CVE-2026-75760 | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-fac… | |
CVE-2026-82599 | Medium | 5.4 | 2026-08-31 | A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the c… |
CVE-2026-82598 | High | 7.3 | 2026-08-31 | A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulatio… |
CVE-2026-82597 | High | 7.4 | 2026-08-31 | A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation… |
CVE-2026-81315 | | 2026-08-31 | Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-sit… | |
CVE-2026-77956 | | 2026-08-31 | Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir… | |
CVE-2026-82596 | Low | 3.3 | 2026-08-31 | A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDetectedPause of the file src/main/java/o… |
CVE-2026-82595 | High | 7.4 | 2026-08-31 | A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component S… |
CVE-2026-82594 | Medium | 5.0 | 2026-08-31 | A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknown function of the component Annotation Processing. Such man… |
CVE-2026-82593 | Critical | 9.9 | 2026-08-31 | A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module… |
CVE-2026-82592 | Critical | 9.9 | 2026-08-30 | A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting… |
CVE-2026-82591 | Medium | 5.3 | 2026-08-30 | A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of… |
CVE-2026-82590 | Medium | 4.3 | 2026-08-30 | A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smf_nudm_sdm_handle_get of the file src/smf/nudm-handler.c of the c… |
CVE-2026-82589 | Medium | 4.3 | 2026-08-30 | A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_transfer of the file src/amf/namf-handl… |
CVE-2026-82588 | Medium | 4.3 | 2026-08-30 | A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer… |
CVE-2026-56718 | High | 7.5 | 2026-08-30 | AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote… |
CVE-2026-82587 | Medium | 4.3 | 2026-08-30 | A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf… |
CVE-2026-82367 | | 2026-08-30 | Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's… | |
CVE-2026-81643 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In… | |
CVE-2026-81636 | | 2026-08-30 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL… | |
CVE-2026-81633 | | 2026-08-30 | Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyE… | |
CVE-2026-80223 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over Grap… | |
CVE-2026-78693 | | 2026-08-30 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that… | |
CVE-2026-82556 | Medium | 6.3 | 2026-08-30 | A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go… |
CVE-2026-82555 | Low | 3.7 | 2026-08-30 | A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecg… |
CVE-2026-82554 | Medium | 4.3 | 2026-08-30 | A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/add_customer.php. This manipulation of the a… |
CVE-2026-81322 | | 2026-08-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash r… | |
CVE-2026-81319 | | 2026-08-30 | Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEA… | |
CVE-2026-82553 | Medium | 6.3 | 2026-08-30 | A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysq… |
CVE-2026-82552 | Medium | 4.3 | 2026-08-30 | A security vulnerability has been detected in Linux Foundation Magma 1.9.0. Affected by this vulnerability is an unknown functionality of the file tasks/ngap/n… |
CVE-2026-82551 | Medium | 5.3 | 2026-08-30 | A weakness has been identified in Linux Foundation Magma 1.9.0. Affected is an unknown function of the file ngap_amf_handlers.c of the component NGSetup Handle… |
CVE-2026-82550 | Medium | 5.3 | 2026-08-30 | A security flaw has been discovered in Linux Foundation Magma 1.9.0. This impacts an unknown function of the component NGSetupRequest Handler. Performing a man… |
CVE-2026-82549 | High | 8.3 | 2026-08-30 | A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulati… |
CVE-2026-78699 | | 2026-08-30 | Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's… | |
CVE-2026-82658 | Medium | 4.3 | 2026-08-30 | Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read anot… |
CVE-2026-82657 | High | 7.5 | 2026-08-30 | Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can… |
CVE-2026-82656 | Low | 2.6 | 2026-08-30 | Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include… |
CVE-2026-82655 | High | 7.5 | 2026-08-30 | Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers… |
CVE-2026-82654 | High | 8.9 | 2026-08-30 | SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a blo… |
CVE-2026-82653 | High | 8.9 | 2026-08-30 | SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated… |
CVE-2026-82652 | Medium | 5.3 | 2026-08-30 | SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous… |
CVE-2026-82651 | Medium | 4.9 | 2026-08-30 | SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in ke… |
CVE-2026-82650 | Medium | 4.4 | 2026-08-30 | SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POS… |
CVE-2026-82649 | | 2026-08-30 | SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, w… | |
CVE-2026-82648 | High | 7.1 | 2026-08-30 | WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in… |
CVE-2026-82647 | Medium | 6.1 | 2026-08-30 | WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's con… |
CVE-2026-82646 | Medium | 6.1 | 2026-08-30 | WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicio… |
CVE-2026-82645 | High | 8.6 | 2026-08-30 | AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a… |
CVE-2026-82644 | High | 7.5 | 2026-08-30 | WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpo… |