2026 CVEs (page 179)
Page 179 of 669 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74754 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twic… | |
CVE-2026-74753 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perf_event_remove_on_exec() sets remove-on-ex… |
CVE-2026-74752 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKI… |
CVE-2026-74751 | Critical | 9.4 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop lo… |
CVE-2026-74750 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref an… |
CVE-2026-74749 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension __exit_to_user_mode_loop() invo… | |
CVE-2026-74748 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() r… |
CVE-2026-74747 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already… |
CVE-2026-74746 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats o… |
CVE-2026-74745 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity… |
CVE-2026-74744 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit h… |
CVE-2026-74743 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inheri… |
CVE-2026-74742 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll() derives the inde… |
CVE-2026-74741 | High | 7.5 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode… |
CVE-2026-74740 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain tcf_action_exec() handles TC_A… | |
CVE-2026-74739 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struc… |
CVE-2026-74738 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readable_reg callback regmap_sdw_mbq_poll_busy() dec… | |
CVE-2026-74737 | Critical | 9.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet rece… |
CVE-2026-74736 | High | 7.8 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_fr… |
CVE-2026-74735 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seq_file release In pppol2tp_proc_open() an… | |
CVE-2026-74734 | | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in ar_context_release During the error handl… | |
CVE-2026-54556 | | 2026-08-26 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HTTP/2 peer can cause an out-of-memory denial of service in t… | |
CVE-2026-54553 | Medium | 5.4 | 2026-08-26 | Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API do… |
CVE-2026-54550 | High | 7.4 | 2026-08-26 | IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpac… |
CVE-2026-54548 | Low | 3.3 | 2026-08-26 | kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config… |
CVE-2026-54523 | Critical | 9.6 | 2026-08-26 | Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes th… |
CVE-2026-54511 | High | 8.6 | 2026-08-26 | LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/s… |
CVE-2026-13481 | Medium | 5.4 | 2026-08-26 | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME… |
CVE-2026-13480 | Low | 3.1 | 2026-08-26 | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command… |
CVE-2026-13479 | Low | 3.1 | 2026-08-26 | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its comma… |
CVE-2026-7487 | Low | 3.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-79902 | Medium | 5.5 | 2026-08-26 | A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA… |
CVE-2026-77801 | Medium | 6.5 | 2026-08-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain c… |
CVE-2026-75960 | High | 8.1 | 2026-08-26 | Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve p… |
CVE-2026-75896 | Critical | 9.1 | 2026-08-26 | Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Pa… |
CVE-2026-73108 | High | 7.5 | 2026-08-26 | RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the… |
CVE-2026-73102 | Medium | 5.7 | 2026-08-26 | RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied… |
CVE-2026-3035 | Medium | 5.5 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-19271 | High | 7.5 | 2026-08-26 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute L… |
CVE-2026-18252 | High | 7.3 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-15990 | High | 7.5 | 2026-08-26 | The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This… |
CVE-2026-15387 | Medium | 4.3 | 2026-08-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-12717 | | 2026-08-26 | An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Goog… | |
CVE-2026-79619 | | 2026-08-26 | On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host pri… | |
CVE-2026-77658 | High | 7.8 | 2026-08-26 | A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/networ… |
CVE-2026-12587 | | 2026-08-26 | The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generatio… | |
CVE-2026-63041 | High | 8.8 | 2026-08-26 | Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an… |
CVE-2026-15985 | High | 8.1 | 2026-08-26 | The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. Th… |
CVE-2026-80206 | Medium | 5.9 | 2026-08-26 | NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-sup… |
CVE-2026-80205 | High | 7.5 | 2026-08-26 | NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user… |
CVE-2026-80204 | Medium | 5.4 | 2026-08-26 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController whe… |
CVE-2026-80203 | Critical | 9.8 | 2026-08-26 | The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sen… |
CVE-2026-77557 | Critical | 9.8 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the… |
CVE-2026-77554 | Critical | 10.0 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Inje… |
CVE-2026-77553 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to esc… |
CVE-2026-77552 | Critical | 9.8 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a… |
CVE-2026-77551 | Critical | 9.0 | 2026-08-26 | A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display… |
CVE-2026-77550 | Critical | 10.0 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS… |
CVE-2026-77549 | Critical | 9.0 | 2026-08-26 | A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in cer… |
CVE-2026-77548 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to… |
CVE-2026-77547 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-77546 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-77532 | Critical | 9.6 | 2026-08-26 | A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a R… |
CVE-2026-5092 | Medium | 6.4 | 2026-08-26 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versio… |
CVE-2026-3235 | Medium | 5.3 | 2026-08-26 | The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_acces… |
CVE-2026-18080 | Critical | 9.8 | 2026-08-26 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, a… |
CVE-2026-80350 | High | 7.1 | 2026-08-26 | OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped I… |
CVE-2026-80349 | Critical | 9.8 | 2026-08-26 | TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming whi… |
CVE-2026-80348 | High | 8.8 | 2026-08-26 | TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController… |
CVE-2026-80347 | High | 7.5 | 2026-08-26 | mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parse… |
CVE-2026-80346 | High | 7.1 | 2026-08-26 | StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor c… |
CVE-2026-77545 | Critical | 9.0 | 2026-08-26 | A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain dev… |
CVE-2026-77543 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-77542 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to exec… |
CVE-2026-77541 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to e… |
CVE-2026-77540 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a… |
CVE-2026-77539 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a… |
CVE-2026-77538 | High | 8.2 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges w… |
CVE-2026-77537 | Critical | 10.0 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command I… |
CVE-2026-77536 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi O… |
CVE-2026-77535 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to… |
CVE-2026-77534 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi O… |
CVE-2026-59683 | Critical | 9.8 | 2026-08-26 | The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a f… |
CVE-2026-59682 | Critical | 9.1 | 2026-08-26 | Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3. |
CVE-2026-2388 | Medium | 6.4 | 2026-08-26 | The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is d… |
CVE-2026-19042 | High | 8.8 | 2026-08-26 | A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands… |
CVE-2026-18794 | High | 8.2 | 2026-08-26 | The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data. |
CVE-2026-16444 | High | 7.5 | 2026-08-26 | Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to w… |
CVE-2026-80237 | High | 8.8 | 2026-08-26 | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell ba… |
CVE-2026-80236 | High | 8.2 | 2026-08-26 | Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and r… |
CVE-2026-80235 | Critical | 9.8 | 2026-08-26 | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell… |
CVE-2026-80234 | Medium | 5.3 | 2026-08-26 | CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists… |
CVE-2026-80233 | High | 7.2 | 2026-08-26 | CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload… |
CVE-2026-77533 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to… |
CVE-2026-19538 | High | 7.5 | 2026-08-26 | The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or T… |
CVE-2026-19401 | High | 7.5 | 2026-08-26 | Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS C… |
CVE-2026-19197 | Medium | 6.3 | 2026-08-26 | A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recove… |
CVE-2026-18916 | High | 7.5 | 2026-08-26 | Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote cl… |
CVE-2026-18664 | Critical | 9.1 | 2026-08-26 | When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian system… |
CVE-2026-9668 | Medium | 6.3 | 2026-08-26 | With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database querie… |