2026 CVEs (page 168)
Page 168 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82273 | Medium | 6.5 | 2026-08-28 | Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitte… |
CVE-2026-82272 | Medium | 6.5 | 2026-08-28 | Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain access… |
CVE-2026-82271 | Medium | 6.5 | 2026-08-28 | R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' co… |
CVE-2026-82270 | High | 7.5 | 2026-08-28 | Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attacke… |
CVE-2026-82269 | High | 8.1 | 2026-08-28 | Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys ca… |
CVE-2026-82268 | High | 7.5 | 2026-08-28 | Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without s… |
CVE-2026-82267 | Medium | 5.4 | 2026-08-28 | Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant… |
CVE-2026-82266 | Critical | 9.8 | 2026-08-28 | Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. A… |
CVE-2026-82265 | Medium | 6.5 | 2026-08-28 | Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensit… |
CVE-2026-82264 | Medium | 6.8 | 2026-08-28 | Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. At… |
CVE-2026-82263 | Medium | 6.8 | 2026-08-28 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL par… |
CVE-2026-82262 | Medium | 6.8 | 2026-08-28 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host val… |
CVE-2026-82021 | High | 8.3 | 2026-08-28 | Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by… |
CVE-2026-82020 | Medium | 6.8 | 2026-08-28 | Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to ove… |
CVE-2026-81849 | High | 8.8 | 2026-08-28 | Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticate… |
CVE-2026-77939 | Medium | 6.5 | 2026-08-28 | Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbi… |
CVE-2026-77586 | High | 8.0 | 2026-08-28 | In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by… |
CVE-2026-77218 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_fir… |
CVE-2026-77217 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/disp… |
CVE-2026-77184 | Medium | 5.2 | 2026-08-28 | In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CRE… |
CVE-2026-76798 | Medium | 6.3 | 2026-08-28 | The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them f… |
CVE-2026-76797 | Medium | 6.3 | 2026-08-28 | The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreads… |
CVE-2026-76794 | Medium | 4.6 | 2026-08-28 | MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can i… |
CVE-2026-75486 | High | 8.0 | 2026-08-28 | Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute a… |
CVE-2026-75126 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The foll… |
CVE-2026-75125 | Medium | 4.9 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_a… |
CVE-2026-75124 | High | 7.5 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _r… |
CVE-2026-75123 | High | 7.2 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test… |
CVE-2026-75122 | High | 7.2 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certifica… |
CVE-2026-75121 | High | 7.2 | 2026-08-28 | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_memb… |
CVE-2026-72984 | High | 8.8 | 2026-08-28 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-70331 | Medium | 5.4 | 2026-08-28 | Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-70309 | Medium | 5.4 | 2026-08-28 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-66798 | Medium | 4.3 | 2026-08-28 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-66324 | Medium | 6.5 | 2026-08-28 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-66323 | Medium | 5.4 | 2026-08-28 | Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-62904 | Medium | 5.4 | 2026-08-28 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58616 | Medium | 4.4 | 2026-08-28 | Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to d… |
CVE-2026-56100 | High | 8.1 | 2026-08-28 | SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system… |
CVE-2026-55834 | Medium | 4.3 | 2026-08-28 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts… |
CVE-2026-55673 | | 2026-08-28 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor… | |
CVE-2026-55634 | Critical | 9.9 | 2026-08-28 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/… |
CVE-2026-55584 | High | 7.5 | 2026-08-28 | phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attack… |
CVE-2026-55569 | Medium | 6.6 | 2026-08-28 | aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink… |
CVE-2026-55566 | Medium | 4.3 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp… |
CVE-2026-55565 | Critical | 9.9 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/stre… |
CVE-2026-55559 | Critical | 9.8 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into… |
CVE-2026-55552 | High | 7.5 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normaliz… |
CVE-2026-55549 | Medium | 6.5 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src… |
CVE-2026-55547 | Medium | 4.3 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and I… |
CVE-2026-55545 | Medium | 6.5 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent R… |
CVE-2026-55521 | High | 8.8 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Co… |
CVE-2026-55520 | | 2026-08-28 | Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex tran… | |
CVE-2026-55511 | Critical | 9.1 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL… |
CVE-2026-55509 | | 2026-08-28 | WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py conca… | |
CVE-2026-55485 | High | 8.8 | 2026-08-28 | Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superus… |
CVE-2026-55484 | High | 7.5 | 2026-08-28 | ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/uti… |
CVE-2026-55425 | Medium | 5.0 | 2026-08-28 | Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/… |
CVE-2026-55378 | | 2026-08-28 | JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml pl… | |
CVE-2026-55248 | Critical | 9.1 | 2026-08-28 | plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS port… |
CVE-2026-55247 | Critical | 9.1 | 2026-08-28 | plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py acce… |
CVE-2026-55245 | | 2026-08-28 | Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached… | |
CVE-2026-55220 | | 2026-08-28 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspot… | |
CVE-2026-55215 | High | 7.5 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when… |
CVE-2026-55108 | High | 8.5 | 2026-08-28 | KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the… |
CVE-2026-55068 | | 2026-08-28 | free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfI… | |
CVE-2026-55067 | Medium | 5.0 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the reques… |
CVE-2026-55066 | High | 7.1 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a b… |
CVE-2026-55065 | High | 8.1 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated… |
CVE-2026-55064 | Medium | 4.3 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project ca… |
CVE-2026-54788 | High | 7.5 | 2026-08-28 | dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses… |
CVE-2026-54766 | | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go a… | |
CVE-2026-54755 | Critical | 9.6 | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can… |
CVE-2026-54754 | Critical | 9.6 | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderDa… |
CVE-2026-54746 | Medium | 6.4 | 2026-08-28 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does… |
CVE-2026-54745 | Critical | 10.0 | 2026-08-28 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an… |
CVE-2026-51660 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filte… |
CVE-2026-51659 | High | 7.5 | 2026-08-28 | Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration in… |
CVE-2026-51658 | High | 7.5 | 2026-08-28 | Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration informatio… |
CVE-2026-51657 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configurat… |
CVE-2026-51656 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN… |
CVE-2026-51655 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain MAC filter rules via… |
CVE-2026-51654 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain schedule or scheduled-r… |
CVE-2026-51653 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain storage feature state in… |
CVE-2026-51652 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed… |
CVE-2026-51651 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Smart QoS configuration… |
CVE-2026-51650 | High | 7.5 | 2026-08-28 | Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain remote-management enablem… |
CVE-2026-51649 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configurati… |
CVE-2026-51648 | High | 7.5 | 2026-08-28 | Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN information returned by… |
CVE-2026-51647 | High | 7.5 | 2026-08-28 | Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status… |
CVE-2026-51646 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rule… |
CVE-2026-51645 | Critical | 9.8 | 2026-08-28 | Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative user… |
CVE-2026-51644 | High | 7.5 | 2026-08-28 | Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control sta… |
CVE-2026-51643 | Critical | 9.1 | 2026-08-28 | Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and curren… |
CVE-2026-51642 | High | 7.5 | 2026-08-28 | Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh routing infor… |
CVE-2026-51641 | High | 7.5 | 2026-08-28 | Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration a… |
CVE-2026-51640 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor inf… |
CVE-2026-51639 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi sche… |
CVE-2026-51638 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configurat… |
CVE-2026-51637 | Medium | 4.3 | 2026-08-28 | Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table i… |