2026 CVEs (page 178)
Page 178 of 669 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35445 | | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submit… | |
CVE-2026-32258 | High | 8.1 | 2026-08-26 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with… |
CVE-2026-32257 | High | 8.1 | 2026-08-26 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settin… |
CVE-2026-81036 | High | 8.1 | 2026-08-26 | Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crate… |
CVE-2026-81035 | High | 8.1 | 2026-08-26 | Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, w… |
CVE-2026-81034 | Medium | 6.5 | 2026-08-26 | Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose s… |
CVE-2026-81033 | Medium | 5.3 | 2026-08-26 | Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/in… |
CVE-2026-81032 | Critical | 9.8 | 2026-08-26 | NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp… |
CVE-2026-81031 | High | 7.2 | 2026-08-26 | IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controll… |
CVE-2026-81030 | Medium | 6.5 | 2026-08-26 | Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource… |
CVE-2026-81029 | High | 8.1 | 2026-08-26 | OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request para… |
CVE-2026-81028 | Medium | 4.9 | 2026-08-26 | ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The c… |
CVE-2026-81027 | High | 8.5 | 2026-08-26 | one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix o… |
CVE-2026-80428 | Critical | 9.8 | 2026-08-26 | ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arb… |
CVE-2026-80427 | High | 8.4 | 2026-08-26 | bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied sour… |
CVE-2026-80426 | High | 7.1 | 2026-08-26 | FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.t… |
CVE-2026-54614 | Medium | 4.3 | 2026-08-26 | DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewContro… |
CVE-2026-54606 | | 2026-08-26 | SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/mo… | |
CVE-2026-54569 | Critical | 9.8 | 2026-08-26 | SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthentic… |
CVE-2026-48549 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie pr… |
CVE-2026-48548 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagForm… |
CVE-2026-80589 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk… |
CVE-2026-80588 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mpt… |
CVE-2026-80587 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclus… |
CVE-2026-80586 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a ma… |
CVE-2026-80585 | Critical | 9.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a v… |
CVE-2026-80584 | High | 8.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() a… |
CVE-2026-80583 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" c… |
CVE-2026-80582 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_fault handler do no… |
CVE-2026-80581 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC erro… | |
CVE-2026-80580 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which ca… |
CVE-2026-80579 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() can delete a mode fro… |
CVE-2026-80578 | High | 7.3 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_read(), if copy_to_us… |
CVE-2026-80577 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthor_fw_load_section_entry() skips BO c… | |
CVE-2026-80576 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_i… |
CVE-2026-80575 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50_add() copies the cust… |
CVE-2026-80574 | High | 8.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (… |
CVE-2026-80573 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforce_process_packet() reads fixed fields… | |
CVE-2026-80572 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses… |
CVE-2026-80571 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In papr_phy_attest_… | |
CVE-2026-80570 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error… |
CVE-2026-80569 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmi_f54_work()… |
CVE-2026-80568 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnost… |
CVE-2026-80567 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmi_f54_buf… | |
CVE-2026-80566 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: hynitron_cstxxx - validate touch count and finger IDs The driver allocates max_tou… | |
CVE-2026-80565 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the… |
CVE-2026-80564 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing… | |
CVE-2026-80563 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The "trigge… | |
CVE-2026-80562 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use raw_spinlock_t for the register lock ioh_irq_type() is registered as th… | |
CVE-2026-80561 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_clien… |
CVE-2026-80560 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() cop… |
CVE-2026-80559 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_de… |
CVE-2026-80558 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received fr… |
CVE-2026-80557 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding()… |
CVE-2026-80556 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe… |
CVE-2026-80555 | High | 7.1 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpi… |
CVE-2026-80554 | Critical | 9.3 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel pro… |
CVE-2026-80553 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work… |
CVE-2026-80552 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of t… |
CVE-2026-80551 | Critical | 9.3 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need… |
CVE-2026-80550 | High | 7.9 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() co… |
CVE-2026-80549 | High | 8.2 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called… |
CVE-2026-80548 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_r… |
CVE-2026-80547 | High | 8.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synch… |
CVE-2026-80546 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrb_msg_to_type6cprb_msgx()… |
CVE-2026-80545 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrb_msg_to_type6_ep11cprb_… |
CVE-2026-80544 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcrypt_msgtype6_sen… |
CVE-2026-80543 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrb_msg_to_t… | |
CVE-2026-80542 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() amdgpu_dm_cr… | |
CVE-2026-80541 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits… |
CVE-2026-80540 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of… |
CVE-2026-80539 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpu_cs_pass1() dispatches on… | |
CVE-2026-80538 | High | 7.1 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfs_rtginode_load xfs_rtginode_ensure() treats every xfs_rtgin… |
CVE-2026-80537 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfs_rtrefcountbt_compute_ma… |
CVE-2026-80536 | High | 8.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays eac… |
CVE-2026-80535 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the… | |
CVE-2026-80534 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfs_dq_get_next_id xfs_dq_get_next_id() takes the quota i… | |
CVE-2026-80533 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair LOLLM noticed a longsta… | |
CVE-2026-80532 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrep_iunlink_resolve_bucket is… | |
CVE-2026-80531 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a potential UAF if the… |
CVE-2026-80530 | High | 7.1 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two… |
CVE-2026-80529 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquot_commit_pass2() v… | |
CVE-2026-80528 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply() stores a `ceph_md… |
CVE-2026-80527 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader can hang forever in __… |
CVE-2026-80526 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_control_put() does not do… |
CVE-2026-80525 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipc_config_d… | |
CVE-2026-80524 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in optee_ffa_lend_protmem Sashiko (locally) reports a possible… | |
CVE-2026-80523 | High | 7.1 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal… |
CVE-2026-80522 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cr… |
CVE-2026-80521 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dea… |
CVE-2026-80520 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpn_crypto_kill_key assumes both cry… |
CVE-2026-80519 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold… |
CVE-2026-75062 | | 2026-08-26 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior… | |
CVE-2026-74754 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twic… | |
CVE-2026-74753 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perf_event_remove_on_exec() sets remove-on-ex… |
CVE-2026-74752 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKI… |
CVE-2026-74751 | Critical | 9.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop lo… |
CVE-2026-74750 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref an… |
CVE-2026-74749 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension __exit_to_user_mode_loop() invo… | |
CVE-2026-74748 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() r… |