2026 CVEs (page 176)
Page 176 of 668 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75005 | High | 7.5 | 2026-08-27 | Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in grap… |
CVE-2026-74848 | High | 7.5 | 2026-08-27 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive… |
CVE-2026-59355 | Medium | 6.1 | 2026-08-27 | In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An at… |
CVE-2026-59354 | Critical | 9.6 | 2026-08-27 | In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registrati… |
CVE-2026-32566 | Critical | 9.8 | 2026-08-27 | Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. |
CVE-2026-32564 | High | 8.5 | 2026-08-27 | Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. |
CVE-2026-32550 | High | 8.5 | 2026-08-27 | Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions. |
CVE-2026-32479 | Critical | 9.3 | 2026-08-27 | Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. |
CVE-2026-27330 | High | 8.6 | 2026-08-27 | Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions. |
CVE-2026-78333 | High | 8.8 | 2026-08-27 | The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activ… |
CVE-2026-78139 | Medium | 4.3 | 2026-08-27 | The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions u… |
CVE-2026-78138 | Medium | 4.3 | 2026-08-27 | The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbi… |
CVE-2026-78137 | High | 7.5 | 2026-08-27 | The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticat… |
CVE-2026-78125 | Medium | 5.3 | 2026-08-27 | The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2… |
CVE-2026-77991 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write d… | |
CVE-2026-77990 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read at… | |
CVE-2026-77989 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current req… | |
CVE-2026-77035 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user… | |
CVE-2026-77034 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own… | |
CVE-2026-77018 | High | 8.8 | 2026-08-27 | The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently wr… |
CVE-2026-77017 | High | 7.7 | 2026-08-27 | The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed d… |
CVE-2026-77016 | Critical | 9.6 | 2026-08-27 | The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain t… |
CVE-2026-76549 | Medium | 5.9 | 2026-08-27 | The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could all… |
CVE-2026-59278 | Medium | 6.5 | 2026-08-27 | JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default… |
CVE-2026-59275 | Medium | 6.6 | 2026-08-27 | A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload… |
CVE-2026-59274 | Medium | 6.5 | 2026-08-27 | The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can… |
CVE-2026-59271 | Medium | 5.3 | 2026-08-27 | When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 S… |
CVE-2026-59270 | Critical | 9.4 | 2026-08-27 | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all avai… |
CVE-2026-47894 | Medium | 4.9 | 2026-08-27 | Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config… |
CVE-2026-47893 | High | 7.5 | 2026-08-27 | A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception… |
CVE-2026-47892 | Critical | 9.8 | 2026-08-27 | A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Sp… |
CVE-2026-47891 | Critical | 9.8 | 2026-08-27 | A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7… |
CVE-2026-47890 | Critical | 9.8 | 2026-08-27 | Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8… |
CVE-2026-47889 | High | 7.5 | 2026-08-27 | A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 … |
CVE-2026-47888 | High | 7.5 | 2026-08-27 | A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Fra… |
CVE-2026-47887 | Medium | 6.1 | 2026-08-27 | A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open… |
CVE-2026-47886 | High | 7.5 | 2026-08-27 | Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power ope… |
CVE-2026-47885 | High | 7.5 | 2026-08-27 | The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Sprin… |
CVE-2026-47884 | Critical | 9.8 | 2026-08-27 | Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where… |
CVE-2026-47883 | Medium | 6.1 | 2026-08-27 | UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Sp… |
CVE-2026-47881 | Medium | 5.9 | 2026-08-27 | Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded… |
CVE-2026-47880 | Medium | 5.4 | 2026-08-27 | A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, erro… |
CVE-2026-47879 | High | 7.7 | 2026-08-27 | Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 -… |
CVE-2026-47878 | Medium | 5.6 | 2026-08-27 | DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject(… |
CVE-2026-47877 | High | 8.2 | 2026-08-27 | Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security… |
CVE-2026-47875 | Medium | 5.6 | 2026-08-27 | Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrus… |
CVE-2026-47864 | Medium | 6.4 | 2026-08-27 | SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with C… |
CVE-2026-47849 | High | 7.1 | 2026-08-27 | Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) reque… |
CVE-2026-19715 | High | 7.5 | 2026-08-27 | The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and… |
CVE-2026-19454 | Medium | 4.4 | 2026-08-27 | The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an adm… |
CVE-2026-19225 | Medium | 6.6 | 2026-08-27 | The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any singl… |
CVE-2026-19223 | High | 7.2 | 2026-08-27 | The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a… |
CVE-2026-16569 | Medium | 4.3 | 2026-08-27 | The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities bef… |
CVE-2026-16568 | Medium | 4.3 | 2026-08-27 | The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user o… |
CVE-2026-16567 | Medium | 5.3 | 2026-08-27 | The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauth… |
CVE-2026-13416 | Low | 3.5 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Edi… |
CVE-2026-13415 | High | 7.2 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the… |
CVE-2026-13414 | Medium | 4.8 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (an… |
CVE-2026-81491 | High | 7.3 | 2026-08-27 | A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file… |
CVE-2026-16895 | | 2026-08-27 | A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs duri… | |
CVE-2026-81486 | Medium | 5.3 | 2026-08-27 | A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_context of the file src/index.ts of the comp… |
CVE-2026-81485 | Medium | 5.3 | 2026-08-27 | A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file s… |
CVE-2026-19398 | | 2026-08-27 | An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corrupt… | |
CVE-2026-81421 | High | 7.3 | 2026-08-27 | A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The… |
CVE-2026-80183 | | 2026-08-27 | In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain b… | |
CVE-2026-47874 | Medium | 5.3 | 2026-08-27 | The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessiv… |
CVE-2026-47863 | Medium | 5.9 | 2026-08-27 | In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Rea… |
CVE-2026-47862 | Medium | 5.4 | 2026-08-27 | An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive… |
CVE-2026-47861 | Medium | 6.3 | 2026-08-27 | An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP da… |
CVE-2026-47860 | Medium | 6.5 | 2026-08-27 | An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message… |
CVE-2026-47859 | Medium | 5.4 | 2026-08-27 | RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet cou… |
CVE-2026-47857 | Medium | 5.9 | 2026-08-27 | In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Rea… |
CVE-2026-47856 | Medium | 6.3 | 2026-08-27 | Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a cl… |
CVE-2026-47852 | High | 7.5 | 2026-08-27 | A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-47851 | High | 7.5 | 2026-08-27 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1… |
CVE-2026-47850 | Medium | 4.3 | 2026-08-27 | Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. S… |
CVE-2026-47845 | Medium | 5.3 | 2026-08-27 | In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen… |
CVE-2026-81203 | High | 7.3 | 2026-08-26 | A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=lo… |
CVE-2026-80158 | Medium | 5.5 | 2026-08-26 | A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind p… |
CVE-2026-75340 | Critical | 9.1 | 2026-08-26 | The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forg… |
CVE-2026-75338 | Critical | 9.8 | 2026-08-26 | disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/confi… |
CVE-2026-75336 | Critical | 9.8 | 2026-08-26 | Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. |
CVE-2026-75332 | Critical | 9.1 | 2026-08-26 | Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download(). |
CVE-2026-75330 | Critical | 9.8 | 2026-08-26 | The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module paramet… |
CVE-2026-69129 | | 2026-08-26 | KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster acce… | |
CVE-2026-65956 | | 2026-08-26 | KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same publ… | |
CVE-2026-47666 | High | 7.6 | 2026-08-26 | Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through c… |
CVE-2026-47665 | High | 8.7 | 2026-08-26 | Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through f… |
CVE-2026-21808 | Medium | 4.1 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an… |
CVE-2026-21807 | Low | 3.9 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buf… |
CVE-2026-81202 | High | 7.3 | 2026-08-26 | A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component… |
CVE-2026-77611 | High | 7.1 | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested obj… |
CVE-2026-77368 | High | 7.6 | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping on… |
CVE-2026-77317 | High | 8.1 | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a… |
CVE-2026-77298 | | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Autho… | |
CVE-2026-75333 | High | 7.5 | 2026-08-26 | yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations withou… |
CVE-2026-75331 | Medium | 4.6 | 2026-08-26 | tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditor… |
CVE-2026-75329 | Critical | 9.8 | 2026-08-26 | The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the fu… |
CVE-2026-75328 | High | 7.5 | 2026-08-26 | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability: |
CVE-2026-65930 | | 2026-08-26 | LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrat… |