2026 CVEs (page 174)
Page 174 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-37006 | Critical | 9.8 | 2026-08-27 | A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via maliciou… |
CVE-2026-37004 | Critical | 9.8 | 2026-08-27 | BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands… |
CVE-2026-37003 | Critical | 9.8 | 2026-08-27 | Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, L… |
CVE-2026-36102 | High | 7.2 | 2026-08-27 | An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmi… |
CVE-2026-35869 | Critical | 9.8 | 2026-08-27 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs d… |
CVE-2026-35868 | Critical | 9.8 | 2026-08-27 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4. This flaw occu… |
CVE-2026-34620 | Medium | 5.5 | 2026-08-27 | DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker coul… |
CVE-2026-34616 | Medium | 5.5 | 2026-08-27 | DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-30612 | Critical | 9.8 | 2026-08-27 | An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to… |
CVE-2026-25250 | Medium | 6.0 | 2026-08-27 | EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable." |
CVE-2026-19092 | Critical | 9.8 | 2026-08-27 | The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticat… |
CVE-2026-18886 | | 2026-08-27 | ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauth… | |
CVE-2026-18885 | | 2026-08-27 | ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated… | |
CVE-2026-18374 | Medium | 4.9 | 2026-08-27 | Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier m… |
CVE-2026-10036 | High | 8.8 | 2026-08-27 | SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml ch… |
CVE-2026-81827 | | 2026-08-27 | Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation… | |
CVE-2026-81826 | | 2026-08-27 | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already posses… | |
CVE-2026-81820 | | 2026-08-27 | Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; *… | |
CVE-2026-81819 | | 2026-08-27 | Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying… | |
CVE-2026-81818 | | 2026-08-27 | Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an org… | |
CVE-2026-81817 | | 2026-08-27 | Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The rout… | |
CVE-2026-81735 | Critical | 10.0 | 2026-08-27 | startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpSe… |
CVE-2026-81727 | High | 7.1 | 2026-08-27 | NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows a… |
CVE-2026-81726 | High | 7.0 | 2026-08-27 | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-contr… |
CVE-2026-81725 | Low | 3.7 | 2026-08-27 | NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption… |
CVE-2026-81724 | Medium | 5.3 | 2026-08-27 | NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial… |
CVE-2026-81723 | Low | 3.7 | 2026-08-27 | NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on ev… |
CVE-2026-81722 | High | 7.5 | 2026-08-27 | nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_co… |
CVE-2026-81721 | High | 7.5 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded mem… |
CVE-2026-81720 | Medium | 6.2 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory cond… |
CVE-2026-81719 | High | 7.8 | 2026-08-27 | openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/u… |
CVE-2026-81718 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 it… |
CVE-2026-81717 | Low | 3.5 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable d… |
CVE-2026-81716 | Medium | 5.2 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a… |
CVE-2026-81715 | Low | 3.3 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-to… |
CVE-2026-81714 | High | 7.0 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust ancho… |
CVE-2026-81707 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge th… |
CVE-2026-81706 | Medium | 6.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed… |
CVE-2026-81705 | High | 7.5 | 2026-08-27 | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g… |
CVE-2026-81704 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256… |
CVE-2026-81703 | Medium | 5.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with… |
CVE-2026-81702 | Critical | 9.8 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public k… |
CVE-2026-81701 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unkn… |
CVE-2026-81700 | Critical | 9.8 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by onl… |
CVE-2026-81699 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory… |
CVE-2026-81698 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadat… |
CVE-2026-81697 | Medium | 5.5 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FI… |
CVE-2026-81696 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious… |
CVE-2026-81695 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft enc… |
CVE-2026-81694 | Low | 3.3 | 2026-08-27 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before… |
CVE-2026-81693 | High | 7.5 | 2026-08-27 | openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with e… |
CVE-2026-81692 | High | 7.5 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to s… |
CVE-2026-81691 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigu… |
CVE-2026-81690 | High | 7.3 | 2026-08-27 | openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with… |
CVE-2026-81689 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys acr… |
CVE-2026-81688 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash withou… |
CVE-2026-81687 | Medium | 5.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craf… |
CVE-2026-81686 | Medium | 6.2 | 2026-08-27 | openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authori… |
CVE-2026-81685 | Low | 3.3 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line sepa… |
CVE-2026-81684 | Medium | 6.2 | 2026-08-27 | In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command l… |
CVE-2026-81683 | High | 8.4 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPre… |
CVE-2026-81682 | Medium | 6.2 | 2026-08-27 | openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable… |
CVE-2026-81681 | Medium | 4.6 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption… |
CVE-2026-81680 | Medium | 4.0 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slo… |
CVE-2026-81679 | High | 7.7 | 2026-08-27 | OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administ… |
CVE-2026-81678 | High | 7.5 | 2026-08-27 | AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64… |
CVE-2026-81664 | Medium | 5.3 | 2026-08-27 | The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.De… |
CVE-2026-81335 | High | 7.5 | 2026-08-27 | Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/b… |
CVE-2026-81334 | Medium | 6.1 | 2026-08-27 | darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-… |
CVE-2026-81102 | Low | 3.1 | 2026-08-27 | The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for it… |
CVE-2026-81101 | Medium | 6.5 | 2026-08-27 | The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given… |
CVE-2026-81100 | Medium | 6.8 | 2026-08-27 | tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpSe… |
CVE-2026-81099 | Medium | 6.8 | 2026-08-27 | tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServer… |
CVE-2026-81098 | Critical | 9.1 | 2026-08-27 | The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the… |
CVE-2026-81097 | High | 8.4 | 2026-08-27 | The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning metho… |
CVE-2026-81096 | Critical | 10.0 | 2026-08-27 | ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_cod… |
CVE-2026-81095 | Medium | 6.8 | 2026-08-27 | pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFacto… |
CVE-2026-81094 | Critical | 9.1 | 2026-08-27 | The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/… |
CVE-2026-81093 | High | 8.6 | 2026-08-27 | The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the… |
CVE-2026-81092 | Medium | 6.8 | 2026-08-27 | mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.Ser… |
CVE-2026-81091 | High | 8.6 | 2026-08-27 | The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/s… |
CVE-2026-80213 | Medium | 4.0 | 2026-08-27 | An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking it… |
CVE-2026-80212 | High | 7.5 | 2026-08-27 | An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcPa… |
CVE-2026-80211 | Medium | 5.9 | 2026-08-27 | FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and upd… |
CVE-2026-80210 | Medium | 6.5 | 2026-08-27 | FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it re… |
CVE-2026-80209 | Medium | 4.3 | 2026-08-27 | The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIE… |
CVE-2026-80208 | High | 8.2 | 2026-08-27 | APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterce… |
CVE-2026-80207 | Medium | 5.3 | 2026-08-27 | APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation… |
CVE-2026-79988 | | 2026-08-27 | The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previous… | |
CVE-2026-79720 | Medium | 5.0 | 2026-08-27 | Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning… |
CVE-2026-79719 | Medium | 5.0 | 2026-08-27 | Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning… |
CVE-2026-79718 | Medium | 5.0 | 2026-08-27 | Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning… |
CVE-2026-79653 | | 2026-08-27 | In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.stor… | |
CVE-2026-78251 | | 2026-08-27 | DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits… | |
CVE-2026-78002 | High | 7.5 | 2026-08-27 | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending speciall… |
CVE-2026-75871 | High | 8.2 | 2026-08-27 | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19… |
CVE-2026-75573 | Medium | 4.4 | 2026-08-27 | In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and… |
CVE-2026-75357 | Critical | 9.8 | 2026-08-27 | An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components. |
CVE-2026-75159 | Medium | 5.9 | 2026-08-27 | An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a… |
CVE-2026-71402 | Medium | 5.4 | 2026-08-27 | An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as th… |