2026 CVEs (page 173)
Page 173 of 472 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14651 | Low | 3.3 | 2026-07-04 | A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluat… |
CVE-2026-14650 | Low | 3.3 | 2026-07-04 | A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Charact… |
CVE-2026-14649 | High | 7.3 | 2026-07-04 | A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is the function test_input of the file /saveVote.php. Performing a manipulatio… |
CVE-2026-14648 | High | 7.3 | 2026-07-04 | A security vulnerability has been detected in code-projects Online Voting System up to 0.x/1.0. This issue affects the function test_input of the file /authent… |
CVE-2026-14647 | Medium | 4.3 | 2026-07-04 | A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of… |
CVE-2026-14642 | High | 7.3 | 2026-07-04 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /edit_… |
CVE-2026-14641 | High | 7.3 | 2026-07-04 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-14640 | High | 7.3 | 2026-07-04 | A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login… |
CVE-2026-14639 | Medium | 6.3 | 2026-07-04 | A vulnerability has been found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /ecommerce-website-php/customer/my_account.php?… |
CVE-2026-14638 | Medium | 6.3 | 2026-07-04 | A flaw has been found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /patient.php. This manipulation of the argum… |
CVE-2026-14637 | High | 8.2 | 2026-07-04 | A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element… |
CVE-2026-12746 | High | 8.1 | 2026-07-04 | Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the pr… |
CVE-2026-12740 | High | 8.1 | 2026-07-04 | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirec… |
CVE-2026-14636 | Medium | 5.4 | 2026-07-04 | A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4314fc015a63a7c6e910c89df. Impacted is the function do_uploa… |
CVE-2026-14635 | High | 7.3 | 2026-07-04 | A security flaw has been discovered in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This issue affects some unkn… |
CVE-2026-14634 | Medium | 4.3 | 2026-07-04 | A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability affects the fu… |
CVE-2026-14633 | Medium | 4.3 | 2026-07-04 | A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unknown part of t… |
CVE-2026-14632 | Medium | 4.3 | 2026-07-04 | A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 95dfa8cebbb87ab46ae450643a07241274a74dce. Affected by this issue is the function… |
CVE-2026-14630 | Low | 3.1 | 2026-07-04 | A vulnerability has been found in ForceInjection AI-fundermentals 2.0/3.0. Affected by this vulnerability is the function get_conversation_history of the file… |
CVE-2026-14629 | Medium | 4.3 | 2026-07-04 | A flaw has been found in RT-Thread up to 5.2.2. Affected is the function read/write/sys_ioctl of the file components/lwp/lwp_syscall.c of the component Paramet… |
CVE-2026-14535 | High | 8.8 | 2026-07-04 | In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on ev… |
CVE-2026-14534 | High | 8.8 | 2026-07-04 | Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_… |
CVE-2026-14628 | Medium | 5.3 | 2026-07-04 | A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the… |
CVE-2026-14627 | Medium | 5.6 | 2026-07-04 | A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gat… |
CVE-2026-53362 | High | 7.8 | 2026-07-04 | In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the p… |
CVE-2026-53361 | High | 7.1 | 2026-07-04 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() co… |
CVE-2026-53360 | High | 8.8 | 2026-07-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when u… |
CVE-2026-53359 | High | 8.8 | 2026-07-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("… |
CVE-2026-14626 | Medium | 4.3 | 2026-07-04 | A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agen… |
CVE-2026-14625 | Medium | 6.3 | 2026-07-04 | A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file tui_gateway/server.p… |
CVE-2026-12196 | | 2026-07-04 | HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts Hestia… | |
CVE-2026-12195 | | 2026-07-04 | myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user par… | |
CVE-2026-14624 | Medium | 4.3 | 2026-07-04 | A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go/src/amf/ngap/handler.go of the component… |
CVE-2026-14623 | Medium | 4.3 | 2026-07-04 | A vulnerability was determined in omec-project amf up to 2.1.1. This issue affects the function RRCInactiveTransitionReport of the component NGAP Message Handl… |
CVE-2026-14622 | High | 7.3 | 2026-07-04 | A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code o… |
CVE-2026-14621 | Low | 3.1 | 2026-07-04 | A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broke… |
CVE-2026-14619 | Medium | 6.3 | 2026-07-04 | A flaw has been found in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /medicine.php. This mani… |
CVE-2026-12194 | | 2026-07-04 | PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on t… | |
CVE-2026-14618 | Medium | 4.3 | 2026-07-04 | A vulnerability was detected in Open5GS up to 2.7.7. Affected by this vulnerability is the function amf_nnrf_handle_nf_discover of the file src/amf/nnrf-handle… |
CVE-2026-12252 | High | 7.8 | 2026-07-04 | In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and S… |
CVE-2026-54424 | High | 8.4 | 2026-07-04 | An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec throu… |
CVE-2026-58523 | Medium | 6.5 | 2026-07-03 | Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-14617 | Low | 3.1 | 2026-07-03 | A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate… |
CVE-2026-58597 | Medium | 4.3 | 2026-07-03 | Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58524 | Medium | 5.4 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-58522 | Medium | 6.8 | 2026-07-03 | Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-58426 | Critical | 9.6 | 2026-07-03 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write |
CVE-2026-58424 | High | 8.9 | 2026-07-03 | Permanent Fork PR Workflow Approval Gate Bypass |
CVE-2026-58423 | High | 7.7 | 2026-07-03 | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories |
CVE-2026-58422 | Critical | 9.8 | 2026-07-03 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts |
CVE-2026-58421 | High | 7.5 | 2026-07-03 | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service |
CVE-2026-58419 | High | 7.5 | 2026-07-03 | Notification API leaks private issue metadata after access revocation |
CVE-2026-58418 | Medium | 6.5 | 2026-07-03 | SSRF via HTTP Redirect in Repository Migration |
CVE-2026-58300 | Medium | 6.2 | 2026-07-03 | Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-58299 | High | 7.5 | 2026-07-03 | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network. |
CVE-2026-58298 | High | 7.2 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-58297 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-58296 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-58295 | High | 8.3 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature o… |
CVE-2026-58294 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58293 | High | 8.1 | 2026-07-03 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58292 | High | 7.5 | 2026-07-03 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58291 | Medium | 6.1 | 2026-07-03 | Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58290 | High | 7.5 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58289 | Critical | 9.0 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58288 | High | 8.3 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58287 | High | 8.3 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58286 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58285 | High | 8.3 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58284 | High | 8.3 | 2026-07-03 | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58283 | High | 8.1 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-58282 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58278 | Medium | 5.4 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58276 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57993 | High | 7.4 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-57992 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57991 | High | 7.4 | 2026-07-03 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over… |
CVE-2026-57988 | High | 7.1 | 2026-07-03 | Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57987 | Medium | 6.5 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-57986 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57985 | High | 7.6 | 2026-07-03 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57984 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57983 | High | 8.7 | 2026-07-03 | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-57981 | High | 8.8 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57977 | High | 7.1 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-57975 | High | 7.5 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57974 | High | 8.8 | 2026-07-03 | Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-56646 | Medium | 6.5 | 2026-07-03 | Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a networ… |
CVE-2026-56645 | High | 8.8 | 2026-07-03 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-55945 | Medium | 4.2 | 2026-07-03 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to… |
CVE-2026-45489 | Medium | 6.5 | 2026-07-03 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2026-45488 | Medium | 5.4 | 2026-07-03 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-28744 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks. |
CVE-2026-28740 | High | 7.1 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-uni… |
CVE-2026-28737 | High | 8.7 | 2026-07-03 | Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer. |
CVE-2026-28705 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names… |
CVE-2026-28699 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. |
CVE-2026-27783 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. |
CVE-2026-27780 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-prot… |
CVE-2026-27779 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. |