2026 CVEs (page 18)
Page 18 of 659 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8067 | Medium | 6.5 | 2026-09-29 | An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot th… |
CVE-2026-8066 | Critical | 9.1 | 2026-09-29 | A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write… |
CVE-2026-8065 | Critical | 9.1 | 2026-09-29 | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to uplo… |
CVE-2026-86843 | Medium | 6.3 | 2026-09-29 | The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight… |
CVE-2026-84739 | High | 8.7 | 2026-09-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain c… |
CVE-2026-81930 | Medium | 6.3 | 2026-09-29 | Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API en… |
CVE-2026-81914 | Medium | 4.3 | 2026-09-29 | Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, with… |
CVE-2026-81862 | Medium | 6.5 | 2026-09-29 | Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOpera… |
CVE-2026-7395 | | 2026-09-29 | Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclos… | |
CVE-2026-76720 | Medium | 4.3 | 2026-09-29 | A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. |
CVE-2026-76719 | High | 8.2 | 2026-09-29 | A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions. |
CVE-2026-76718 | High | 8.2 | 2026-09-29 | A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions. |
CVE-2026-4523 | Low | 3.7 | 2026-09-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain c… |
CVE-2026-19547 | | 2026-09-29 | Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript… | |
CVE-2026-15390 | | 2026-09-29 | Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP… | |
CVE-2026-11796 | | 2026-09-29 | Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which… | |
CVE-2026-10518 | Medium | 4.3 | 2026-09-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain condi… |
CVE-2026-102474 | Medium | 4.0 | 2026-09-29 | A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six byt… |
CVE-2026-102473 | Medium | 5.5 | 2026-09-29 | A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local… |
CVE-2026-96440 | | 2026-09-29 | Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 ve… | |
CVE-2026-96431 | | 2026-09-29 | Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allo… | |
CVE-2026-96430 | | 2026-09-29 | Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated u… | |
CVE-2026-96429 | | 2026-09-29 | SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arb… | |
CVE-2026-96428 | | 2026-09-29 | SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbi… | |
CVE-2026-92142 | High | 8.8 | 2026-09-29 | Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the r… |
CVE-2026-91085 | Medium | 6.3 | 2026-09-29 | Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactor… |
CVE-2026-91048 | Critical | 9.8 | 2026-09-29 | The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no match… |
CVE-2026-91012 | Critical | 9.8 | 2026-09-29 | org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the fil… |
CVE-2026-84154 | Critical | 9.9 | 2026-09-29 | A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an att… |
CVE-2026-101169 | | 2026-09-29 | In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for… | |
CVE-2026-86158 | High | 7.7 | 2026-09-29 | Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint… |
CVE-2026-86157 | Medium | 5.6 | 2026-09-29 | Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify app… |
CVE-2026-102293 | High | 7.3 | 2026-09-29 | A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the compo… |
CVE-2026-102292 | Medium | 4.3 | 2026-09-29 | A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functional… |
CVE-2026-102290 | Low | 3.5 | 2026-09-29 | A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a… |
CVE-2026-102264 | Low | 3.5 | 2026-09-29 | A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file fron… |
CVE-2026-102263 | Medium | 4.7 | 2026-09-29 | A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file… |
CVE-2026-102261 | Medium | 5.4 | 2026-09-29 | A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of… |
CVE-2026-97029 | Medium | 5.7 | 2026-09-29 | Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the san… |
CVE-2026-97024 | High | 7.1 | 2026-09-29 | A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host syst… |
CVE-2026-102422 | High | 8.1 | 2026-09-29 | shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening… |
CVE-2026-102414 | Low | 3.7 | 2026-09-29 | pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer tha… |
CVE-2026-102249 | High | 7.3 | 2026-09-29 | A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of… |
CVE-2026-102248 | High | 7.3 | 2026-09-29 | A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The ma… |
CVE-2026-102247 | Medium | 6.8 | 2026-09-29 | A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component… |
CVE-2026-102245 | High | 7.3 | 2026-09-29 | A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleb… |
CVE-2026-97685 | | 2026-09-29 | An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question o… | |
CVE-2026-102244 | Medium | 4.3 | 2026-09-29 | A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes… |
CVE-2026-102243 | High | 7.4 | 2026-09-29 | A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/tes… |
CVE-2026-102241 | Low | 2.7 | 2026-09-29 | A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the… |
CVE-2026-96326 | High | 7.2 | 2026-09-29 | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field i… |
CVE-2026-102240 | Critical | 10.0 | 2026-09-29 | A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network T… |
CVE-2026-101878 | High | 7.5 | 2026-09-29 | Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50)… |
CVE-2026-101860 | High | 8.8 | 2026-09-29 | A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugin… |
CVE-2026-101859 | Medium | 5.4 | 2026-09-29 | A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/del_… |
CVE-2026-101858 | Medium | 4.7 | 2026-09-29 | A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/W… |
CVE-2026-101354 | Critical | 9.6 | 2026-09-29 | A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Perfo… |
CVE-2026-102374 | Medium | 6.1 | 2026-09-29 | GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects… |
CVE-2026-102373 | Medium | 6.5 | 2026-09-29 | GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can… |
CVE-2026-102372 | Medium | 6.1 | 2026-09-29 | GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary J… |
CVE-2026-101281 | High | 7.3 | 2026-09-29 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the… |
CVE-2026-101280 | High | 7.3 | 2026-09-29 | A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Reco… |
CVE-2026-101279 | Medium | 6.5 | 2026-09-29 | A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc… |
CVE-2026-101278 | Medium | 4.3 | 2026-09-29 | A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_… |
CVE-2026-18747 | Medium | 6.8 | 2026-09-29 | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing… |
CVE-2026-18746 | Medium | 5.9 | 2026-09-29 | parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of… |
CVE-2026-18417 | Medium | 6.5 | 2026-09-29 | The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field (ctx->user_data = IN… |
CVE-2026-102367 | Medium | 5.4 | 2026-09-29 | mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing… |
CVE-2026-102366 | Medium | 4.4 | 2026-09-29 | mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file type… |
CVE-2026-102365 | Medium | 6.5 | 2026-09-29 | mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers ca… |
CVE-2026-102364 | Medium | 5.4 | 2026-09-29 | mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing thei… |
CVE-2026-102363 | Low | 3.7 | 2026-09-29 | mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to re… |
CVE-2026-102362 | Medium | 5.3 | 2026-09-29 | mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbi… |
CVE-2026-102361 | Critical | 9.1 | 2026-09-29 | mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any store… |
CVE-2026-101277 | Medium | 6.5 | 2026-09-29 | A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set of the file dkim.c o… |
CVE-2026-101265 | Low | 3.1 | 2026-09-29 | A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation… |
CVE-2026-101264 | Critical | 9.1 | 2026-09-29 | A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the a… |
CVE-2026-101263 | Critical | 9.1 | 2026-09-29 | A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation… |
CVE-2026-102335 | High | 7.1 | 2026-09-28 | Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject ar… |
CVE-2026-102334 | High | 7.4 | 2026-09-28 | Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses again… |
CVE-2026-102333 | Medium | 6.1 | 2026-09-28 | httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffi… |
CVE-2026-102332 | Medium | 6.1 | 2026-09-28 | Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can la… |
CVE-2026-101262 | Critical | 9.1 | 2026-09-28 | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulatio… |
CVE-2026-101261 | Critical | 9.1 | 2026-09-28 | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the a… |
CVE-2026-101260 | Critical | 9.1 | 2026-09-28 | A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Perform… |
CVE-2026-102297 | Medium | 4.3 | 2026-09-28 | ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission… |
CVE-2026-102296 | Medium | 6.5 | 2026-09-28 | ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting a… |
CVE-2026-102281 | High | 7.5 | 2026-09-28 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pat… |
CVE-2026-101205 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out… |
CVE-2026-101204 | Medium | 6.3 | 2026-09-28 | A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. Th… |
CVE-2026-101203 | Medium | 6.3 | 2026-09-28 | A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipula… |
CVE-2026-101202 | Medium | 6.3 | 2026-09-28 | A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipula… |
CVE-2026-101188 | High | 8.3 | 2026-09-28 | A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such man… |
CVE-2026-101093 | Medium | 5.4 | 2026-09-28 | Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verifica… |
CVE-2026-101092 | Medium | 5.3 | 2026-09-28 | SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths fr… |
CVE-2026-101091 | High | 7.1 | 2026-09-28 | SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .s… |
CVE-2026-97027 | Low | 3.6 | 2026-09-28 | Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files… |
CVE-2026-97026 | Low | 3.9 | 2026-09-28 | Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive uma… |
CVE-2026-97025 | Low | 3.2 | 2026-09-28 | Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local user… |
CVE-2026-91096 | High | 7.5 | 2026-09-28 | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) f… |