2026 CVEs (page 179)
Page 179 of 472 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49090 | Medium | 6.5 | 2026-07-01 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can su… |
CVE-2026-46680 | High | 7.8 | 2026-07-01 | containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that can… |
CVE-2026-58454 | High | 7.5 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execu… |
CVE-2026-58453 | Critical | 9.8 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to g… |
CVE-2026-58452 | High | 8.8 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achie… |
CVE-2026-57721 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App… |
CVE-2026-57720 | Medium | 4.3 | 2026-07-01 | Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Th… |
CVE-2026-57516 | High | 8.8 | 2026-07-01 | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplyi… |
CVE-2026-56152 | Medium | 5.3 | 2026-07-01 | Incorrect Authorization (CWE-863) in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACL… |
CVE-2026-56151 | Medium | 6.5 | 2026-07-01 | Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specia… |
CVE-2026-56150 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacke… |
CVE-2026-56149 | Medium | 4.9 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-56148 | Medium | 6.5 | 2026-07-01 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a spec… |
CVE-2026-54399 | High | 7.5 | 2026-07-01 | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows … |
CVE-2026-49088 | Medium | 4.4 | 2026-07-01 | Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (… |
CVE-2026-49087 | Medium | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-34117 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/t… |
CVE-2026-34116 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcri… |
CVE-2026-34115 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/t… |
CVE-2026-34114 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/tran… |
CVE-2026-34113 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec(\"php jobs/speech_… |
CVE-2026-34112 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_au… |
CVE-2026-34111 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/spee… |
CVE-2026-34110 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/compl… |
CVE-2026-34109 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio… |
CVE-2026-34108 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$l… |
CVE-2026-34107 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate… |
CVE-2026-34106 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_… |
CVE-2026-34105 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, ty… |
CVE-2026-34104 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\"… |
CVE-2026-34103 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FR… |
CVE-2026-34102 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\… |
CVE-2026-34101 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, d… |
CVE-2026-34100 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, durat… |
CVE-2026-34099 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET[… |
CVE-2026-34098 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129)… |
CVE-2026-34097 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text_file.php (lines 94, 101… |
CVE-2026-34096 | Medium | 4.6 | 2026-07-01 | Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribute in designer.php (line 57). An authent… |
CVE-2026-27409 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-20244 | High | 7.5 | 2026-07-01 | A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded im… |
CVE-2026-20243 | High | 7.5 | 2026-07-01 | A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded im… |
CVE-2026-20217 | High | 7.5 | 2026-07-01 | A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded… |
CVE-2026-20216 | High | 7.5 | 2026-07-01 | A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected devic… |
CVE-2026-20215 | High | 7.5 | 2026-07-01 | A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded imp… |
CVE-2026-20214 | High | 7.5 | 2026-07-01 | A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded im… |
CVE-2026-20213 | High | 7.5 | 2026-07-01 | A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded imp… |
CVE-2026-20191 | High | 7.5 | 2026-07-01 | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container. This vul… |
CVE-2026-13211 | Medium | 4.3 | 2026-07-01 | The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with… |
CVE-2026-12480 | Medium | 5.5 | 2026-07-01 | Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides i… |
CVE-2026-8857 | High | 8.8 | 2026-07-01 | A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This… |
CVE-2026-8480 | Medium | 4.3 | 2026-07-01 | A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revo… |
CVE-2026-58127 | Critical | 9.8 | 2026-07-01 | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemot… |
CVE-2026-58126 | Critical | 9.8 | 2026-07-01 | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by expl… |
CVE-2026-58038 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerabilit… |
CVE-2026-58037 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58036 | High | 7.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58033 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58032 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58030 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This… |
CVE-2026-58029 | Medium | 6.5 | 2026-07-01 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/A… |
CVE-2026-58028 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2026-58027 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program f… |
CVE-2026-58026 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58025 | Critical | 9.8 | 2026-07-01 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiIm… |
CVE-2026-58024 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-57517 | Critical | 9.8 | 2026-07-01 | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries… |
CVE-2026-24270 | Critical | 9.8 | 2026-07-01 | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit of this vulnerability might lead to denia… |
CVE-2026-24266 | Medium | 5.9 | 2026-07-01 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerabilit… |
CVE-2026-24264 | High | 7.5 | 2026-07-01 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit… |
CVE-2026-24260 | High | 8.5 | 2026-07-01 | NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of t… |
CVE-2026-24251 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful ex… |
CVE-2026-24250 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vul… |
CVE-2026-24249 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24248 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulne… |
CVE-2026-24247 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24246 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful ex… |
CVE-2026-24245 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24244 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24243 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24242 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability… |
CVE-2026-24240 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-13707 | High | 7.6 | 2026-07-01 | Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issu… |
CVE-2026-13706 | High | 8.8 | 2026-07-01 | Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils… |
CVE-2026-6688 | High | 7.6 | 2026-07-01 | FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up… |
CVE-2026-6687 | High | 7.6 | 2026-07-01 | FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. Th… |
CVE-2026-6686 | Medium | 4.6 | 2026-07-01 | FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-filling newly allocated clusters. This… |
CVE-2026-6684 | Medium | 4.6 | 2026-07-01 | FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabli… |
CVE-2026-6683 | Medium | 4.6 | 2026-07-01 | FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/sync operations. Th… |
CVE-2026-6682 | High | 7.6 | 2026-07-01 | In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-siz… |
CVE-2026-6283 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-5220 | Medium | 6.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allow… |
CVE-2026-5142 | Medium | 6.5 | 2026-07-01 | A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure She… |
CVE-2026-5138 | Medium | 4.3 | 2026-07-01 | A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occu… |
CVE-2026-5135 | Medium | 6.5 | 2026-07-01 | A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup va… |
CVE-2026-58399 | | 2026-07-01 | @acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in val… | |
CVE-2026-58035 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58034 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerabili… |
CVE-2026-58031 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-2891 | | 2026-07-01 | The following Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they connect to a malicious SIP server and receive malformed data. HP is rel… | |
CVE-2026-23537 | Critical | 9.1 | 2026-07-01 | A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary J… |