2026 CVEs (page 171)
Page 171 of 471 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41434 | Low | 3.3 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-12154 | Medium | 6.4 | 2026-07-06 | The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of t… |
CVE-2026-48316 | Critical | 10.0 | 2026-07-06 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-43825 | High | 7.3 | 2026-07-06 | Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document categorization module; introduced in O… |
CVE-2026-40257 | Medium | 5.5 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2026-40141 | Critical | 9.9 | 2026-07-06 | A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of cer… |
CVE-2026-40140 | High | 7.5 | 2026-07-06 | BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insuff… |
CVE-2026-40139 | Critical | 9.8 | 2026-07-06 | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication request… |
CVE-2026-40138 | High | 8.1 | 2026-07-06 | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validat… |
CVE-2026-5268 | Critical | 9.1 | 2026-07-06 | An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remot… |
CVE-2026-59196 | High | 7.1 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal ali… |
CVE-2026-59195 | High | 8.2 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names direct… |
CVE-2026-59194 | High | 7.1 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remov… |
CVE-2026-59152 | Medium | 5.0 | 2026-07-06 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an attacker who can send an HTTP request to a server running… |
CVE-2026-58203 | Medium | 5.3 | 2026-07-06 | pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a config… |
CVE-2026-13122 | Medium | 5.3 | 2026-07-06 | OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token tha… |
CVE-2026-7185 | | 2026-07-06 | A validation vulnerability has been identified in certain web features related to file management or upload in several products of the TAO 2.0 suite. This vuln… | |
CVE-2026-58380 | High | 7.3 | 2026-07-06 | A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one b… |
CVE-2026-54893 | | 2026-07-06 | URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's e… | |
CVE-2026-13698 | High | 7.5 | 2026-07-06 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 clie… |
CVE-2026-13708 | High | 7.5 | 2026-07-06 | Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks t… |
CVE-2026-13705 | High | 7.1 | 2026-07-06 | Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. … |
CVE-2026-6901 | High | 7.7 | 2026-07-06 | Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5. |
CVE-2026-6900 | High | 7.4 | 2026-07-06 | Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5. |
CVE-2026-58226 | | 2026-07-06 | Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding. hpax decod… | |
CVE-2026-56810 | | 2026-07-06 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked… | |
CVE-2026-4249 | High | 8.6 | 2026-07-06 | The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and cont… |
CVE-2026-49297 | High | 8.1 | 2026-07-06 | Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing AP… |
CVE-2026-49042 | High | 7.3 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are re… |
CVE-2026-46588 | High | 7.3 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20… |
CVE-2026-46587 | High | 7.3 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20… |
CVE-2026-44937 | High | 8.2 | 2026-07-06 | Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 an… |
CVE-2026-44936 | Medium | 5.0 | 2026-07-06 | Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14… |
CVE-2026-12686 | | 2026-07-06 | An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the… | |
CVE-2026-9165 | High | 7.7 | 2026-07-06 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated G… |
CVE-2026-56140 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific He… |
CVE-2026-56139 | Medium | 5.3 | 2026-07-06 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes… |
CVE-2026-55994 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy… |
CVE-2026-55993 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmo… |
CVE-2026-53913 | Critical | 9.8 | 2026-07-06 | Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. … |
CVE-2026-49365 | Medium | 5.3 | 2026-07-06 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exp… |
CVE-2026-49099 | Medium | 5.3 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerabil… |
CVE-2026-49098 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kaf… |
CVE-2026-49097 | Medium | 6.5 | 2026-07-06 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC… |
CVE-2026-49086 | Medium | 6.5 | 2026-07-06 | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub cons… |
CVE-2026-48206 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component. The camel-jira producers read their… |
CVE-2026-48205 | Critical | 9.1 | 2026-07-06 | Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation paramete… |
CVE-2026-48204 | Critical | 9.8 | 2026-07-06 | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects… |
CVE-2026-48203 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSR… |
CVE-2026-46726 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vert… |
CVE-2026-46592 | High | 7.5 | 2026-07-06 | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selec… |
CVE-2026-46591 | High | 8.2 | 2026-07-06 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHER… |
CVE-2026-46590 | High | 8.8 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) throug… |
CVE-2026-46585 | High | 7.5 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads th… |
CVE-2026-46584 | Low | 3.7 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (M… |
CVE-2026-46457 | High | 7.5 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but… |
CVE-2026-46456 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchan… |
CVE-2026-46455 | Critical | 9.8 | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAcce… |
CVE-2026-46454 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Cam… |
CVE-2026-46453 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-r… |
CVE-2026-44934 | | 2026-07-06 | A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive… | |
CVE-2026-43867 | Critical | 9.8 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) throug… |
CVE-2026-43866 | High | 7.3 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent… |
CVE-2026-43865 | High | 8.1 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances usi… |
CVE-2026-42527 | High | 8.1 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defens… |
CVE-2026-40859 | High | 8.1 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type ap… |
CVE-2026-40047 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling componen… |
CVE-2026-24014 | Critical | 9.8 | 2026-07-06 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient valida… |
CVE-2026-24013 | Critical | 9.1 | 2026-07-06 | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attack… |
CVE-2026-24012 | High | 7.5 | 2026-07-06 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval o… |
CVE-2026-1433 | | 2026-07-06 | uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensi… | |
CVE-2026-14809 | High | 7.5 | 2026-07-06 | Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to r… |
CVE-2026-6382 | Critical | 9.1 | 2026-07-06 | The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File… |
CVE-2026-14808 | Critical | 9.8 | 2026-07-06 | Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a s… |
CVE-2026-14807 | Critical | 9.8 | 2026-07-06 | ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code a… |
CVE-2026-14802 | High | 7.3 | 2026-07-06 | A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the co… |
CVE-2026-14801 | Low | 3.3 | 2026-07-06 | A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtin_probe_duration of the file sr… |
CVE-2026-14800 | Medium | 4.3 | 2026-07-06 | A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This… |
CVE-2026-12083 | High | 8.1 | 2026-07-06 | The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication… |
CVE-2026-11962 | High | 8.8 | 2026-07-06 | The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who… |
CVE-2026-11855 | High | 8.8 | 2026-07-06 | The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escap… |
CVE-2026-11766 | High | 8.0 | 2026-07-06 | The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on u… |
CVE-2026-10830 | High | 8.8 | 2026-07-06 | The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated… |
CVE-2026-14799 | Medium | 6.3 | 2026-07-06 | A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. Impacted is an unknown function of the file /customer/my_account.php?my_wishlist. The m… |
CVE-2026-14798 | Medium | 6.3 | 2026-07-06 | A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /apartment-visitor/… |
CVE-2026-14797 | Medium | 6.3 | 2026-07-06 | A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. This vulnerability affects unknown code of the file /apartment-visitor/edi… |
CVE-2026-14796 | Medium | 6.3 | 2026-07-06 | A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. This affects an unknown part of the file /apartment-visitor/report.php. Perform… |
CVE-2026-14795 | Medium | 6.3 | 2026-07-06 | A vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartmen… |
CVE-2026-14794 | Medium | 4.3 | 2026-07-06 | A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsContr… |
CVE-2026-14793 | Medium | 4.3 | 2026-07-06 | A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the c… |
CVE-2026-14792 | Medium | 6.5 | 2026-07-06 | A security vulnerability has been detected in Formbricks 5.0.0. This impacts an unknown function of the file apps/web/modules/survey/link/actions.ts of the com… |
CVE-2026-14791 | Low | 3.5 | 2026-07-06 | A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesReq… |
CVE-2026-14790 | Low | 3.3 | 2026-07-06 | A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler… |
CVE-2026-14789 | Low | 3.3 | 2026-07-06 | A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of… |
CVE-2026-14803 | Medium | 6.5 | 2026-07-06 | Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value`… |
CVE-2026-14788 | Low | 3.3 | 2026-07-06 | A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/co… |
CVE-2026-14787 | Low | 3.3 | 2026-07-06 | A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb… |
CVE-2026-14786 | Low | 3.3 | 2026-07-06 | A security flaw has been discovered in radareorg radare2 up to 6.1.6. This impacts the function r_str_word_get0set of the file libr/util/str.c. The manipulatio… |
CVE-2026-14784 | Medium | 6.3 | 2026-07-06 | A vulnerability was identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown function of the file backend/pkg/docker/client.go of the component Doc… |
CVE-2026-14783 | Medium | 4.3 | 2026-07-06 | A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Exec… |