2026 CVEs (page 170)
Page 170 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82239 | High | 8.1 | 2026-08-28 | Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, cr… |
CVE-2026-82238 | Low | 3.1 | 2026-08-28 | filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by… |
CVE-2026-82237 | Low | 3.1 | 2026-08-28 | filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by pa… |
CVE-2026-82236 | Low | 3.1 | 2026-08-28 | File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can… |
CVE-2026-82235 | Medium | 5.9 | 2026-08-28 | filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscal… |
CVE-2026-82234 | High | 8.2 | 2026-08-28 | SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution onl… |
CVE-2026-82233 | Medium | 5.7 | 2026-08-28 | SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary… |
CVE-2026-82222 | Critical | 10.0 | 2026-08-28 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1. |
CVE-2026-82111 | Medium | 4.3 | 2026-08-28 | A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component… |
CVE-2026-81777 | Medium | 5.3 | 2026-08-28 | Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons fo… |
CVE-2026-81733 | | 2026-08-28 | WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The… | |
CVE-2026-81732 | | 2026-08-28 | WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to u… | |
CVE-2026-78073 | | 2026-08-28 | Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors | |
CVE-2026-78072 | | 2026-08-28 | Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1 | |
CVE-2026-78071 | | 2026-08-28 | Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attr… | |
CVE-2026-78070 | | 2026-08-28 | Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL… | |
CVE-2026-73209 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process i… |
CVE-2026-73208 | High | 7.4 | 2026-08-28 | An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the aud… |
CVE-2026-6128 | Medium | 6.4 | 2026-08-28 | The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all… |
CVE-2026-5510 | Medium | 6.4 | 2026-08-28 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all ve… |
CVE-2026-52687 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory… |
CVE-2026-52681 | Low | 3.1 | 2026-08-28 | Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the activ… |
CVE-2026-42395 | Medium | 4.3 | 2026-08-28 | A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The log… |
CVE-2026-42393 | Low | 3.1 | 2026-08-28 | The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access t… |
CVE-2026-42392 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response return… |
CVE-2026-42391 | High | 7.5 | 2026-08-28 | An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow dis… |
CVE-2026-42008 | Medium | 4.3 | 2026-08-28 | Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that ho… |
CVE-2026-42007 | Critical | 9.1 | 2026-08-28 | An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write… |
CVE-2026-40205 | Medium | 5.9 | 2026-08-28 | An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configur… |
CVE-2026-40204 | Low | 3.1 | 2026-08-28 | None None None No publicly available exploits are known. |
CVE-2026-40203 | Low | 3.7 | 2026-08-28 | When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail a… |
CVE-2026-40019 | Medium | 5.9 | 2026-08-28 | An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This… |
CVE-2026-40018 | High | 7.4 | 2026-08-28 | None None None No publicly available exploits are known. |
CVE-2026-40017 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD c… |
CVE-2026-40015 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out… |
CVE-2026-40014 | Medium | 6.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message… |
CVE-2026-40013 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSiev… |
CVE-2026-33607 | Medium | 4.3 | 2026-08-28 | An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for a… |
CVE-2026-33606 | Medium | 4.8 | 2026-08-28 | Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protoc… |
CVE-2026-33605 | High | 7.5 | 2026-08-28 | An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mod… |
CVE-2026-33604 | Medium | 5.9 | 2026-08-28 | An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body… |
CVE-2026-33263 | Medium | 4.3 | 2026-08-28 | When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If r… |
CVE-2026-27852 | High | 7.5 | 2026-08-28 | An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes exce… |
CVE-2026-18918 | | 2026-08-28 | In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, ap… | |
CVE-2026-18393 | Medium | 5.4 | 2026-08-28 | A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A rem… |
CVE-2026-9548 | Medium | 6.5 | 2026-08-28 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22… |
CVE-2026-9491 | Medium | 4.3 | 2026-08-28 | A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensiti… |
CVE-2026-82123 | Medium | 6.5 | 2026-08-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic. |
CVE-2026-80724 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: prevent read-only mappings from becoming writable vmclock_miscdev_mmap() re… |
CVE-2026-80723 | High | 8.4 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan… |
CVE-2026-80722 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211_process_rx_t… |
CVE-2026-80721 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in iso_conn After iso_conn_del(), ISO… |
CVE-2026-80720 | High | 7.5 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_ioend iomap_split_ioend can split bios that… |
CVE-2026-80719 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: mm: mglru: fix stale batch updates after memcg reparenting The mglru page table walker ba… | |
CVE-2026-80718 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() In pcpu_create_ch… |
CVE-2026-80717 | High | 7.5 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication par… |
CVE-2026-80716 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a linked stream parks a… |
CVE-2026-80715 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy application is kill… | |
CVE-2026-80714 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created… |
CVE-2026-80713 | High | 8.4 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: io_uring: preserve task restrictions across exec Per-task restrictions apply to all rings… |
CVE-2026-80712 | High | 8.4 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SET_FEATURE qcom_spi_send_c… |
CVE-2026-80711 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger… | |
CVE-2026-80710 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmt_buffer_size in dasd_eckd_check_device_f… |
CVE-2026-80709 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper l… |
CVE-2026-80708 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() The helper… | |
CVE-2026-80707 | High | 7.5 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer Zero the allo… |
CVE-2026-80706 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: can: softing: fw_parse(): validate firmware record spans fw_parse() reads a fixed record… |
CVE-2026-80705 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21_add_phantom_plane() is successful Verify that the phantom… | |
CVE-2026-80704 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_… | |
CVE-2026-80703 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Prevent unauthori… | |
CVE-2026-80702 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size Two sites in vmwgfx_resourc… |
CVE-2026-80701 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmw_cursor_plane_atomic_check() bo… | |
CVE-2026-80700 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmw_external_bo_copy()… |
CVE-2026-80699 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested sta… | |
CVE-2026-80698 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks f… | |
CVE-2026-80697 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid f_path for page cache sharing Previously, backing files for page cach… | |
CVE-2026-80696 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Fix reading the minimum alarm voltage Coverity reports an out-of-bounds… |
CVE-2026-80695 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_update_client(), the 16-… | |
CVE-2026-80694 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller mtk_handle_i… |
CVE-2026-80693 | Critical | 9.3 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpf_get_reg_intr_vecs(… |
CVE-2026-80692 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretica… |
CVE-2026-80691 | High | 7.5 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblock_execu… |
CVE-2026-80690 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba->rpmbs list in ufshcd Initialize the hba->rpmbs list in u… | |
CVE-2026-80689 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions mmio_trace_rw… | |
CVE-2026-80688 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: riscv: drop __init from vec_check_unaligned_access_speed_all_cpus This function runs with… | |
CVE-2026-80687 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: iommufd/viommu: Release the igroup lock on the vdevice_size error path iommufd_vdevice_al… | |
CVE-2026-80686 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE pte_pfn() and pte_dir… | |
CVE-2026-80685 | High | 7.1 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read __page_2 for order-1 folios in snapshot_page() snapshot_page() curren… |
CVE-2026-80684 | Critical | 9.3 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq_iv_create() can… |
CVE-2026-80683 | High | 8.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own sco_conn reference sco_conn_del() drops a referen… |
CVE-2026-80682 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: riscv/mm: use physical alignment for vmemmap_start_pfn RISC-V computes vmemmap_start_pfn… |
CVE-2026-80681 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the et… |
CVE-2026-80680 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the… |
CVE-2026-80679 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasd_release_space() checks the impleme… | |
CVE-2026-80678 | High | 8.4 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slav… |
CVE-2026-80677 | High | 7.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() dev_has_sync_state()… |
CVE-2026-80676 | | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driver_override infrastructure When a driver is probed th… | |
CVE-2026-80675 | High | 7.1 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map->… |
CVE-2026-80674 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUT… |
CVE-2026-80673 | Critical | 9.8 | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolvi… |