2026 CVEs (page 173)
Page 173 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-38349 | High | 7.5 | 2026-08-28 | An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2026-38348 | High | 7.5 | 2026-08-28 | An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a craf… |
CVE-2026-38347 | High | 7.5 | 2026-08-28 | A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Servi… |
CVE-2026-38346 | High | 7.5 | 2026-08-28 | An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2026-38345 | Medium | 6.5 | 2026-08-28 | A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a De… |
CVE-2026-38344 | High | 7.5 | 2026-08-28 | A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Servi… |
CVE-2026-38343 | Medium | 6.5 | 2026-08-28 | An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a… |
CVE-2026-18965 | High | 8.8 | 2026-08-28 | PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly acces… |
CVE-2026-18717 | High | 7.4 | 2026-08-28 | ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, compl… |
CVE-2026-17610 | | 2026-08-28 | In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32… | |
CVE-2026-81934 | High | 7.1 | 2026-08-27 | Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TL… |
CVE-2026-81931 | | 2026-08-27 | Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the… | |
CVE-2026-81893 | Medium | 4.7 | 2026-08-27 | A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can lea… |
CVE-2026-81838 | High | 7.1 | 2026-08-27 | A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to wr… |
CVE-2026-81834 | Medium | 6.3 | 2026-08-27 | A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Ha… |
CVE-2026-81833 | Medium | 5.5 | 2026-08-27 | A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/hel… |
CVE-2026-81731 | Medium | 5.4 | 2026-08-27 | Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is… |
CVE-2026-81730 | High | 8.2 | 2026-08-27 | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The… |
CVE-2026-81729 | Medium | 6.5 | 2026-08-27 | Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php call… |
CVE-2026-81728 | High | 8.1 | 2026-08-27 | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdo… |
CVE-2026-81530 | Medium | 5.6 | 2026-08-27 | A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the app… |
CVE-2026-81529 | High | 7.1 | 2026-08-27 | Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes un… |
CVE-2026-81528 | Medium | 5.4 | 2026-08-27 | A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a repl… |
CVE-2026-81527 | Medium | 6.5 | 2026-08-27 | A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and qu… |
CVE-2026-81526 | Medium | 6.5 | 2026-08-27 | The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server… |
CVE-2026-81525 | High | 8.1 | 2026-08-27 | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct… |
CVE-2026-81524 | Medium | 5.4 | 2026-08-27 | A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the dri… |
CVE-2026-81523 | Medium | 4.4 | 2026-08-27 | A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted with… |
CVE-2026-81522 | High | 8.1 | 2026-08-27 | A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An applicatio… |
CVE-2026-81521 | Medium | 6.5 | 2026-08-27 | The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping… |
CVE-2026-77438 | High | 7.5 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the… |
CVE-2026-76640 | High | 7.5 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated p… |
CVE-2026-76639 | High | 8.8 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitra… |
CVE-2026-75889 | High | 7.7 | 2026-08-27 | Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify… |
CVE-2026-74820 | | 2026-08-27 | ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticate… | |
CVE-2026-6876 | | 2026-08-27 | ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated… | |
CVE-2026-66353 | | 2026-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value… | |
CVE-2026-65931 | | 2026-08-27 | LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticat… | |
CVE-2026-59324 | High | 8.2 | 2026-08-27 | When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessage… |
CVE-2026-59322 | Medium | 6.3 | 2026-08-27 | The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte pay… |
CVE-2026-59321 | Medium | 4.2 | 2026-08-27 | A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. th… |
CVE-2026-59320 | Medium | 6.5 | 2026-08-27 | When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one lin… |
CVE-2026-59319 | Medium | 4.3 | 2026-08-27 | RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape()… |
CVE-2026-59317 | Medium | 6.5 | 2026-08-27 | DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new Bi… |
CVE-2026-59316 | High | 8.2 | 2026-08-27 | Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker… |
CVE-2026-59315 | Medium | 5.3 | 2026-08-27 | The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0… |
CVE-2026-59314 | Low | 3.7 | 2026-08-27 | Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file… |
CVE-2026-59313 | Critical | 9.8 | 2026-08-27 | Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7… |
CVE-2026-59311 | Medium | 6.8 | 2026-08-27 | A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer… |
CVE-2026-59307 | High | 8.0 | 2026-08-27 | An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bea… |
CVE-2026-59306 | Low | 3.1 | 2026-08-27 | Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Strea… |
CVE-2026-59305 | Low | 3.1 | 2026-08-27 | Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4… |
CVE-2026-59304 | Low | 3.1 | 2026-08-27 | Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Str… |
CVE-2026-59303 | Low | 3.1 | 2026-08-27 | Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud S… |
CVE-2026-59302 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4… |
CVE-2026-59301 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Funct… |
CVE-2026-59300 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Functio… |
CVE-2026-59299 | Low | 3.1 | 2026-08-27 | Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Sprin… |
CVE-2026-59298 | Low | 3.1 | 2026-08-27 | Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud… |
CVE-2026-59297 | Low | 3.1 | 2026-08-27 | Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function… |
CVE-2026-59294 | Medium | 5.9 | 2026-08-27 | ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and… |
CVE-2026-59293 | Medium | 6.6 | 2026-08-27 | Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vuln… |
CVE-2026-59292 | Low | 3.2 | 2026-08-27 | PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.pr… |
CVE-2026-59291 | Low | 2.0 | 2026-08-27 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring C… |
CVE-2026-59289 | High | 7.5 | 2026-08-27 | Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying reposito… |
CVE-2026-59288 | High | 7.4 | 2026-08-27 | The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the… |
CVE-2026-59287 | Medium | 5.9 | 2026-08-27 | Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring f… |
CVE-2026-59286 | High | 8.1 | 2026-08-27 | The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject ma… |
CVE-2026-59285 | High | 8.1 | 2026-08-27 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4 |
CVE-2026-59284 | High | 7.6 | 2026-08-27 | There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4… |
CVE-2026-59283 | Critical | 9.1 | 2026-08-27 | Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL… |
CVE-2026-59282 | High | 7.5 | 2026-08-27 | Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a D… |
CVE-2026-59281 | Medium | 6.1 | 2026-08-27 | Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Er… |
CVE-2026-59277 | Low | 3.7 | 2026-08-27 | Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a gi… |
CVE-2026-59276 | Medium | 5.9 | 2026-08-27 | Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison… |
CVE-2026-55758 | | 2026-08-27 | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src… | |
CVE-2026-54732 | Medium | 6.5 | 2026-08-27 | libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileN… |
CVE-2026-54721 | High | 8.8 | 2026-08-27 | Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject… |
CVE-2026-54718 | High | 7.2 | 2026-08-27 | Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the… |
CVE-2026-54713 | Low | 3.7 | 2026-08-27 | CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBe… |
CVE-2026-54687 | Critical | 9.8 | 2026-08-27 | n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database f… |
CVE-2026-53580 | High | 8.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a no… |
CVE-2026-53579 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML onl… | |
CVE-2026-53578 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML onl… | |
CVE-2026-48996 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize… | |
CVE-2026-47727 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the share… | |
CVE-2026-37198 | High | 7.5 | 2026-08-27 | An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet. |
CVE-2026-37073 | Medium | 5.3 | 2026-08-27 | Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configu… |
CVE-2026-37072 | Critical | 9.8 | 2026-08-27 | Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. |
CVE-2026-37071 | Critical | 9.8 | 2026-08-27 | Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker wit… |
CVE-2026-37070 | Medium | 6.5 | 2026-08-27 | Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by… |
CVE-2026-37069 | Medium | 5.3 | 2026-08-27 | Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthentica… |
CVE-2026-37068 | High | 8.1 | 2026-08-27 | Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role o… |
CVE-2026-37067 | Medium | 5.3 | 2026-08-27 | Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all appli… |
CVE-2026-37066 | Medium | 6.5 | 2026-08-27 | Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authentic… |
CVE-2026-37065 | Critical | 9.1 | 2026-08-27 | Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=. |
CVE-2026-37064 | Medium | 5.3 | 2026-08-27 | User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via… |
CVE-2026-37012 | High | 7.5 | 2026-08-27 | A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credenti… |
CVE-2026-37009 | Medium | 6.5 | 2026-08-27 | A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query… |
CVE-2026-37007 | Critical | 9.8 | 2026-08-27 | A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the… |