2026 CVEs (page 166)
Page 166 of 471 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59936 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated in… |
CVE-2026-59935 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated in… |
CVE-2026-59822 | High | 8.2 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauth… |
CVE-2026-59821 | High | 7.2 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production creat… |
CVE-2026-59820 | Medium | 6.5 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not suffici… |
CVE-2026-59819 | Medium | 4.9 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resol… |
CVE-2026-59807 | Medium | 6.8 | 2026-07-08 | Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting… |
CVE-2026-59806 | High | 7.4 | 2026-07-08 | Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perfo… |
CVE-2026-59805 | Medium | 6.5 | 2026-07-08 | Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase… |
CVE-2026-59804 | Medium | 6.8 | 2026-07-08 | Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthent… |
CVE-2026-59803 | High | 7.5 | 2026-07-08 | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has th… |
CVE-2026-59802 | High | 8.2 | 2026-07-08 | PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malici… |
CVE-2026-58501 | Medium | 5.9 | 2026-07-08 | Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allowing transi… |
CVE-2026-58254 | Medium | 6.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks… |
CVE-2026-58253 | High | 8.8 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was c… |
CVE-2026-58252 | Medium | 6.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user c… |
CVE-2026-58251 | Medium | 6.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user w… |
CVE-2026-58250 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with net… |
CVE-2026-58214 | Medium | 4.3 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client cou… |
CVE-2026-58213 | High | 7.1 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include prot… |
CVE-2026-58210 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client c… |
CVE-2026-58209 | Medium | 4.3 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery a… |
CVE-2026-55760 | High | 7.5 | 2026-07-08 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compi… |
CVE-2026-55575 | | 2026-07-08 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.1, the pop array filter at src/filters/array.ts allocated a… | |
CVE-2026-55404 | High | 7.5 | 2026-07-08 | yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can wri… |
CVE-2026-53624 | Medium | 4.8 | 2026-07-08 | Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-… |
CVE-2026-45045 | Medium | 5.3 | 2026-07-08 | Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header… |
CVE-2026-44512 | Medium | 5.5 | 2026-07-08 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version… |
CVE-2026-44332 | Medium | 5.3 | 2026-07-08 | Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/c… |
CVE-2026-36028 | Medium | 6.8 | 2026-07-08 | A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset |
CVE-2026-36027 | Medium | 6.8 | 2026-07-08 | An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (ADB) and Android De… |
CVE-2026-15154 | Medium | 6.5 | 2026-07-08 | A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (ReDoS), all… |
CVE-2026-14891 | High | 8.7 | 2026-07-08 | HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into… |
CVE-2026-14373 | High | 7.7 | 2026-07-08 | HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow… |
CVE-2026-14361 | Medium | 4.7 | 2026-07-08 | The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output t… |
CVE-2026-59938 | Medium | 5.3 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared image size values that are much too large c… |
CVE-2026-59937 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that caus… |
CVE-2026-50813 | Medium | 6.1 | 2026-07-08 | An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/chang… |
CVE-2026-50812 | Medium | 5.5 | 2026-07-08 | A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can… |
CVE-2026-14362 | Medium | 4.9 | 2026-07-08 | HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network ac… |
CVE-2026-60102 | High | 8.8 | 2026-07-08 | Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() met… |
CVE-2026-59930 | Medium | 4.3 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictabl… |
CVE-2026-59929 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, v… |
CVE-2026-59928 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definit… |
CVE-2026-59927 | Medium | 5.3 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct… |
CVE-2026-59926 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Ad… |
CVE-2026-59925 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs… |
CVE-2026-59924 | Medium | 5.9 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verify… |
CVE-2026-59923 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowin… |
CVE-2026-59922 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character ca… |
CVE-2026-59897 | Medium | 4.8 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a dist… |
CVE-2026-59896 | Medium | 6.5 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per r… |
CVE-2026-59895 | Medium | 6.1 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from pla… |
CVE-2026-59892 | High | 7.5 | 2026-07-08 | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-*… |
CVE-2026-59890 | Medium | 6.1 | 2026-07-08 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in ex… |
CVE-2026-59887 | High | 7.5 | 2026-07-08 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked a… |
CVE-2026-59883 | Medium | 4.7 | 2026-07-08 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact ho… |
CVE-2026-59882 | Medium | 4.2 | 2026-07-08 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing a… |
CVE-2026-59879 | High | 7.5 | 2026-07-08 | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functiona… |
CVE-2026-59731 | High | 8.2 | 2026-07-08 | Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterati… |
CVE-2026-59261 | High | 7.1 | 2026-07-08 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-tru… |
CVE-2026-42505 | Medium | 5.3 | 2026-07-08 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unenc… |
CVE-2026-39822 | High | 7.8 | 2026-07-08 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a sym… |
CVE-2026-29009 | High | 8.2 | 2026-07-08 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malici… |
CVE-2026-29008 | High | 7.5 | 2026-07-08 | U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attack… |
CVE-2026-29007 | Medium | 5.3 | 2026-07-08 | U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote… |
CVE-2026-9074 | Critical | 9.1 | 2026-07-08 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functiona… |
CVE-2026-59880 | High | 7.5 | 2026-07-08 | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit… |
CVE-2026-59877 | Medium | 5.3 | 2026-07-08 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema t… |
CVE-2026-59876 | Medium | 4.8 | 2026-07-08 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map e… |
CVE-2026-59875 | Medium | 5.3 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts… |
CVE-2026-59874 | High | 7.5 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded e… |
CVE-2026-59873 | High | 7.5 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry coun… |
CVE-2026-59871 | Medium | 5.3 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScrip… |
CVE-2026-59870 | Medium | 5.3 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addI… |
CVE-2026-59869 | High | 7.5 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document w… |
CVE-2026-59868 | Medium | 5.3 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document w… |
CVE-2026-59725 | High | 7.5 | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not pro… |
CVE-2026-59724 | High | 7.5 | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can reso… |
CVE-2026-59702 | Critical | 9.3 | 2026-07-08 | repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound re… |
CVE-2026-59262 | Medium | 6.5 | 2026-07-08 | AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retri… |
CVE-2026-57439 | Medium | 5.0 | 2026-07-08 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while p… |
CVE-2026-55761 | Medium | 5.9 | 2026-07-08 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2026-54344 | Medium | 4.7 | 2026-07-08 | ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.ev… |
CVE-2026-53951 | | 2026-07-08 | Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) c… | |
CVE-2026-3144 | High | 8.1 | 2026-07-08 | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the syst… |
CVE-2026-15063 | Medium | 6.3 | 2026-07-08 | A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes… |
CVE-2026-14967 | Low | 3.1 | 2026-07-08 | BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not re… |
CVE-2026-14966 | Low | 3.1 | 2026-07-08 | BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing c… |
CVE-2026-59703 | High | 7.5 | 2026-07-08 | repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories… |
CVE-2026-55874 | High | 7.7 | 2026-07-08 | SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by Copy… |
CVE-2026-55873 | Medium | 4.3 | 2026-07-08 | SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API… |
CVE-2026-55668 | Medium | 6.3 | 2026-07-08 | File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and t… |
CVE-2026-54652 | High | 8.1 | 2026-07-08 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer ro… |
CVE-2026-49147 | High | 7.5 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose… |
CVE-2026-49146 | High | 7.5 | 2026-07-08 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy f… |
CVE-2026-49145 | High | 7.5 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current… |
CVE-2026-24700 | High | 7.2 | 2026-07-08 | An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers wi… |
CVE-2026-24699 | High | 7.2 | 2026-07-08 | An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers wit… |
CVE-2026-24698 | High | 7.2 | 2026-07-08 | An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110… |