2026 CVEs (page 167)
Page 167 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81026 | Medium | 4.8 | 2026-08-29 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before… |
CVE-2026-80488 | Medium | 4.1 | 2026-08-29 | The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, whi… |
CVE-2026-80311 | Medium | 4.3 | 2026-08-29 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting cust… |
CVE-2026-77786 | Medium | 4.9 | 2026-08-29 | The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires… |
CVE-2026-77704 | Low | 2.7 | 2026-08-29 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them ch… |
CVE-2026-77012 | Critical | 9.3 | 2026-08-29 | The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default… |
CVE-2026-77010 | Medium | 6.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not… |
CVE-2026-77008 | Medium | 6.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its s… |
CVE-2026-77007 | High | 7.5 | 2026-08-29 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, a… |
CVE-2026-76586 | High | 7.5 | 2026-08-29 | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side p… |
CVE-2026-76548 | High | 8.2 | 2026-08-29 | The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabil… |
CVE-2026-76547 | Medium | 6.6 | 2026-08-29 | The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing hig… |
CVE-2026-76546 | Medium | 6.8 | 2026-08-29 | The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as cont… |
CVE-2026-19430 | Medium | 5.3 | 2026-08-29 | The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested conte… |
CVE-2026-18234 | Medium | 6.5 | 2026-08-29 | The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not de… |
CVE-2026-18233 | Medium | 6.5 | 2026-08-29 | The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any… |
CVE-2026-17522 | Medium | 5.4 | 2026-08-29 | The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted… |
CVE-2026-17520 | Medium | 4.8 | 2026-08-29 | The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowin… |
CVE-2026-16947 | Critical | 9.1 | 2026-08-29 | The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side v… |
CVE-2026-16600 | High | 7.7 | 2026-08-29 | The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before… |
CVE-2026-16259 | Critical | 9.8 | 2026-08-29 | The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to t… |
CVE-2026-16061 | High | 8.6 | 2026-08-29 | The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a… |
CVE-2026-10522 | Critical | 9.8 | 2026-08-29 | The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthen… |
CVE-2026-41012 | High | 7.7 | 2026-08-29 | Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API a… |
CVE-2026-55867 | | 2026-08-28 | Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implement… | |
CVE-2026-55860 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text pass… |
CVE-2026-55859 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all chara… |
CVE-2026-55858 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector e… |
CVE-2026-55857 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog auth… |
CVE-2026-55856 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java app… |
CVE-2026-55855 | Medium | 6.5 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-55854 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-55848 | High | 8.6 | 2026-08-28 | mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts… |
CVE-2026-55841 | High | 7.5 | 2026-08-28 | Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate… |
CVE-2026-55785 | Low | 3.7 | 2026-08-28 | free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in intern… |
CVE-2026-55784 | High | 7.5 | 2026-08-28 | free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in… |
CVE-2026-55779 | Medium | 5.4 | 2026-08-28 | Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveA… |
CVE-2026-55764 | | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupp… | |
CVE-2026-82333 | High | 7.5 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's fie… |
CVE-2026-82018 | Medium | 6.1 | 2026-08-28 | IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically p… |
CVE-2026-82017 | High | 7.6 | 2026-08-28 | IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access t… |
CVE-2026-81533 | High | 7.1 | 2026-08-28 | An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of… |
CVE-2026-81532 | High | 8.8 | 2026-08-28 | A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exce… |
CVE-2026-81520 | High | 7.5 | 2026-08-28 | A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-base… |
CVE-2026-81518 | High | 7.5 | 2026-08-28 | When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require… |
CVE-2026-81517 | High | 7.5 | 2026-08-28 | An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhau… |
CVE-2026-81490 | High | 7.7 | 2026-08-28 | A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by definin… |
CVE-2026-77078 | High | 7.5 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an un… |
CVE-2026-77063 | Low | 3.7 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a rac… |
CVE-2026-77037 | High | 7.5 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream… |
CVE-2026-76651 | | 2026-08-28 | A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of a… | |
CVE-2026-76650 | | 2026-08-28 | A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SO… | |
CVE-2026-76649 | | 2026-08-28 | A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action requ… | |
CVE-2026-75118 | | 2026-08-28 | A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking o… | |
CVE-2026-55891 | Unrated | | 2026-08-28 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVE… |
CVE-2026-55763 | | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go cal… | |
CVE-2026-55696 | Medium | 4.3 | 2026-08-28 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses ge… |
CVE-2026-55678 | | 2026-08-28 | Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without auth… | |
CVE-2026-51665 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain traceroute diagnostic… |
CVE-2026-51664 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet service enablement… |
CVE-2026-51663 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger wireless scans and r… |
CVE-2026-51662 | High | 7.5 | 2026-08-28 | Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware… |
CVE-2026-51661 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding ru… |
CVE-2026-3686 | Medium | 6.2 | 2026-08-28 | IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources. |
CVE-2026-3627 | Critical | 9.1 | 2026-08-28 | IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker t… |
CVE-2026-22056 | | 2026-08-28 | StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulner… | |
CVE-2026-19295 | Critical | 9.9 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow wi… |
CVE-2026-19294 | Medium | 6.4 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization. |
CVE-2026-19286 | Critical | 9.8 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A p… |
CVE-2026-18904 | High | 8.2 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collisi… |
CVE-2026-18899 | High | 7.5 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal. |
CVE-2026-18891 | High | 8.2 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication. |
CVE-2026-18729 | High | 8.8 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. |
CVE-2026-18545 | Medium | 4.3 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reques… |
CVE-2026-18527 | Critical | 9.9 | 2026-08-28 | IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by A… |
CVE-2026-17203 | High | 7.5 | 2026-08-28 | IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforc… |
CVE-2026-16821 | High | 7.0 | 2026-08-28 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability. |
CVE-2026-13735 | Low | 3.7 | 2026-08-28 | Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data… |
CVE-2026-13734 | Medium | 6.5 | 2026-08-28 | Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late… |
CVE-2026-82343 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count pa… |
CVE-2026-82329 | Critical | 9.8 | 2026-08-28 | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain ad… |
CVE-2026-82306 | Medium | 6.5 | 2026-08-28 | StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Aut… |
CVE-2026-82291 | High | 8.1 | 2026-08-28 | HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication… |
CVE-2026-82290 | Medium | 5.3 | 2026-08-28 | Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users'… |
CVE-2026-82289 | High | 7.4 | 2026-08-28 | Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-… |
CVE-2026-82288 | High | 7.5 | 2026-08-28 | Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line argum… |
CVE-2026-82287 | High | 8.1 | 2026-08-28 | Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Acce… |
CVE-2026-82286 | High | 8.6 | 2026-08-28 | gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary fil… |
CVE-2026-82285 | High | 8.2 | 2026-08-28 | bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication… |
CVE-2026-82284 | High | 8.1 | 2026-08-28 | Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/an… |
CVE-2026-82283 | High | 8.1 | 2026-08-28 | VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. At… |
CVE-2026-82282 | High | 8.0 | 2026-08-28 | Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers ca… |
CVE-2026-82281 | High | 7.4 | 2026-08-28 | Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in… |
CVE-2026-82280 | High | 7.1 | 2026-08-28 | Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-onl… |
CVE-2026-82279 | High | 8.1 | 2026-08-28 | HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. At… |
CVE-2026-82278 | High | 8.8 | 2026-08-28 | BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Pyth… |
CVE-2026-82277 | Critical | 9.8 | 2026-08-28 | Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protectio… |
CVE-2026-82276 | Medium | 5.3 | 2026-08-28 | StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing… |
CVE-2026-82275 | High | 7.5 | 2026-08-28 | Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers… |
CVE-2026-82274 | Medium | 4.7 | 2026-08-28 | Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query para… |