2026 CVEs (page 175)
Page 175 of 472 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11856 | Critical | 9.8 | 2026-07-03 | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one… |
CVE-2026-11586 | High | 7.5 | 2026-07-03 | By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious… |
CVE-2026-11564 | Critical | 9.1 | 2026-07-03 | libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first u… |
CVE-2026-11352 | High | 7.5 | 2026-07-03 | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because t… |
CVE-2026-10536 | Critical | 9.8 | 2026-07-03 | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREA… |
CVE-2026-9725 | Critical | 9.1 | 2026-07-03 | The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5… |
CVE-2026-9626 | Medium | 6.4 | 2026-07-03 | The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up… |
CVE-2026-9180 | Medium | 5.3 | 2026-07-03 | The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including… |
CVE-2026-8892 | Medium | 6.4 | 2026-07-03 | The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fi… |
CVE-2026-8489 | Medium | 6.4 | 2026-07-03 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2026-14352 | High | 7.5 | 2026-07-03 | The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter… |
CVE-2026-13040 | High | 7.2 | 2026-07-03 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all ver… |
CVE-2026-12557 | Medium | 5.3 | 2026-07-03 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plug… |
CVE-2026-11397 | Medium | 5.5 | 2026-07-03 | The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_uplo… |
CVE-2026-8921 | | 2026-07-03 | External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampere… | |
CVE-2026-12960 | | 2026-07-03 | An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Int… | |
CVE-2026-14327 | High | 7.5 | 2026-07-03 | The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. T… |
CVE-2026-12920 | Medium | 4.9 | 2026-07-03 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to… |
CVE-2026-12734 | Medium | 6.4 | 2026-07-03 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorW… |
CVE-2026-12731 | Medium | 6.4 | 2026-07-03 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTit… |
CVE-2026-12729 | Medium | 4.3 | 2026-07-03 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and… |
CVE-2026-8247 | High | 8.8 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary cod… |
CVE-2026-55726 | Medium | 5.3 | 2026-07-03 | The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device l… |
CVE-2026-54477 | Medium | 5.4 | 2026-07-03 | The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks. |
CVE-2026-13768 | Critical | 10.0 | 2026-07-03 | Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns… |
CVE-2026-13728 | Medium | 4.4 | 2026-07-03 | In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resource… |
CVE-2026-13722 | High | 7.2 | 2026-07-03 | WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can… |
CVE-2026-13384 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a spe… |
CVE-2026-13383 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a sp… |
CVE-2026-13377 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Sto… |
CVE-2026-13376 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows S… |
CVE-2026-13375 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integr… |
CVE-2026-13374 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Int… |
CVE-2026-13373 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integr… |
CVE-2026-13371 | Medium | 4.9 | 2026-07-03 | An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data… |
CVE-2026-13368 | High | 8.1 | 2026-07-03 | WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote… |
CVE-2026-13084 | High | 7.5 | 2026-07-03 | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by… |
CVE-2026-13079 | High | 7.8 | 2026-07-03 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT… |
CVE-2026-13054 | High | 7.2 | 2026-07-03 | A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Fireb… |
CVE-2026-13053 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially cra… |
CVE-2026-13050 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a sp… |
CVE-2026-57100 | Critical | 9.9 | 2026-07-02 | Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. |
CVE-2026-54998 | High | 8.8 | 2026-07-02 | Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. |
CVE-2026-45499 | Critical | 9.9 | 2026-07-02 | Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network. |
CVE-2026-41106 | Critical | 9.3 | 2026-07-02 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-26145 | Medium | 4.8 | 2026-07-02 | Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network. |
CVE-2026-50722 | High | 8.1 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH… |
CVE-2026-50721 | High | 8.1 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of a… |
CVE-2026-12413 | High | 7.5 | 2026-07-02 | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The funct… |
CVE-2026-58460 | High | 7.7 | 2026-07-02 | react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files outside the intended… |
CVE-2026-52830 | Critical | 9.4 | 2026-07-02 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file… |
CVE-2026-52192 | High | 7.5 | 2026-07-02 | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C component |
CVE-2026-52191 | High | 7.5 | 2026-07-02 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_444C8C compon… |
CVE-2026-52189 | High | 7.5 | 2026-07-02 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_487330 compon… |
CVE-2026-52188 | Medium | 6.5 | 2026-07-02 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead//sub_497498 compo… |
CVE-2026-38972 | High | 7.8 | 2026-07-02 | Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibr… |
CVE-2026-38971 | Critical | 9.1 | 2026-07-02 | ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_co… |
CVE-2026-38970 | High | 7.5 | 2026-07-02 | pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested… |
CVE-2026-38968 | Critical | 9.8 | 2026-07-02 | ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak… |
CVE-2026-59102 | Medium | 5.4 | 2026-07-02 | Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users'… |
CVE-2026-59101 | Medium | 5.8 | 2026-07-02 | AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network ser… |
CVE-2026-59100 | Medium | 5.0 | 2026-07-02 | LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-gr… |
CVE-2026-59099 | Critical | 9.1 | 2026-07-02 | Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state b… |
CVE-2026-59098 | Medium | 6.5 | 2026-07-02 | LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authentic… |
CVE-2026-59097 | Medium | 5.3 | 2026-07-02 | Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any proje… |
CVE-2026-59096 | High | 7.5 | 2026-07-02 | Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an atta… |
CVE-2026-59095 | High | 7.7 | 2026-07-02 | LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to a… |
CVE-2026-59094 | High | 7.5 | 2026-07-02 | Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive… |
CVE-2026-59093 | High | 8.8 | 2026-07-02 | Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleTo… |
CVE-2026-59092 | High | 7.7 | 2026-07-02 | JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitiv… |
CVE-2026-58580 | Medium | 5.9 | 2026-07-02 | LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginSt… |
CVE-2026-58579 | Medium | 5.4 | 2026-07-02 | RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl… |
CVE-2026-58578 | Medium | 6.5 | 2026-07-02 | LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the… |
CVE-2026-58467 | High | 7.5 | 2026-07-02 | Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or ex… |
CVE-2026-58466 | Critical | 9.8 | 2026-07-02 | AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by… |
CVE-2026-58381 | Medium | 6.1 | 2026-07-02 | A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP fi… |
CVE-2026-52187 | High | 7.5 | 2026-07-02 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_483ba0 compon… |
CVE-2026-7311 | High | 8.1 | 2026-07-02 | The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… |
CVE-2026-58465 | High | 7.5 | 2026-07-02 | Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows una… |
CVE-2026-13743 | | 2026-07-02 | CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This cou… | |
CVE-2026-8699 | | 2026-07-02 | A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient serv… | |
CVE-2026-55952 | High | 7.5 | 2026-07-02 | The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equa… |
CVE-2026-55950 | Medium | 5.9 | 2026-07-02 | Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash… |
CVE-2026-54891 | Low | 3.7 | 2026-07-02 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a n… |
CVE-2026-54887 | Medium | 4.8 | 2026-07-02 | Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling s… |
CVE-2026-54886 | Medium | 4.3 | 2026-07-02 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP c… |
CVE-2026-53422 | Medium | 4.3 | 2026-07-02 | Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and di… |
CVE-2026-50282 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an auth… | |
CVE-2026-50281 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action… | |
CVE-2026-44935 | Critical | 9.9 | 2026-07-02 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 befor… |
CVE-2026-58455 | Critical | 9.8 | 2026-07-02 | Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by ex… |
CVE-2026-44941 | High | 8.4 | 2026-07-02 | A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious reposito… |
CVE-2026-9272 | High | 8.1 | 2026-07-02 | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the A… |
CVE-2026-8079 | High | 7.3 | 2026-07-02 | In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PD… |
CVE-2026-56842 | High | 7.5 | 2026-07-02 | A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Applica… |
CVE-2026-56841 | High | 8.8 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application t… |
CVE-2026-56004 | Critical | 10.0 | 2026-07-02 | A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service fi… |
CVE-2026-55119 | High | 8.1 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escal… |
CVE-2026-55118 | High | 8.3 | 2026-07-02 | A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi… |
CVE-2026-55117 | High | 8.6 | 2026-07-02 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device. |