2026 CVEs (page 180)
Page 180 of 472 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14330 | Medium | 5.5 | 2026-07-01 | Multiple unbounded alloca() calls in the PulseAudio protocol server. |
CVE-2026-14324 | Medium | 6.5 | 2026-07-01 | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. |
CVE-2026-13602 | | 2026-07-01 | We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: *… | |
CVE-2026-12374 | | 2026-07-01 | Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1… | |
CVE-2026-5136 | High | 8.8 | 2026-07-01 | A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an… |
CVE-2026-57692 | Critical | 9.8 | 2026-07-01 | Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2. |
CVE-2026-53356 | High | 7.8 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer… |
CVE-2026-53355 | Critical | 9.8 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so… |
CVE-2026-53354 | High | 8.8 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs developed by Arm… |
CVE-2026-53353 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: hsr: Remove WARN_ONCE() in hsr_addr_is_self(). syzbot reported the warning [0] in hsr_add… |
CVE-2026-53352 | Medium | 4.7 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a multi-threaded… |
CVE-2026-53351 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI Fixes a warning while dumping core… |
CVE-2026-53350 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ASoC: wm_adsp: Fix NULL dereference when removing firmware controls In wm_adsp_control_re… |
CVE-2026-53349 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: destroy stale expectfn expectations on unregister NAT helpers su… |
CVE-2026-53348 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions sdca_dev_unregi… |
CVE-2026-53347 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix driver removal with disabled KMS DRM atomic and modesetting aren't initia… |
CVE-2026-53346 | High | 7.1 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Due to a rustc bug [1]… |
CVE-2026-53345 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying When marking a p… |
CVE-2026-53344 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init Regmap initializa… |
CVE-2026-53343 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow Commit 44e9a3bb76e5 ("ARM… |
CVE-2026-53342 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: arm64: mm: call pagetable dtor when freeing hot-removed page tables Since 5e8eb9aeeda3 ("… |
CVE-2026-53341 | High | 7.8 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() may_decode_fh() accesse… |
CVE-2026-53340 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix clock and pinctrl state inconsistency in runtime PM In i2c_imx_runtime_susp… |
CVE-2026-53339 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() On all modern platforms Qualc… |
CVE-2026-53338 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()… |
CVE-2026-53337 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bond_do_ioctl() In bond_do_ioctl(), slave_d… |
CVE-2026-53336 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: nvmem: layouts: onie-tlv: fix hang on unknown types The EEPROM on my board has a vendor s… |
CVE-2026-53335 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: handle ctx allocation failure DAMON_LRU_SORT allocates the damon_ctx o… |
CVE-2026-53334 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: handle ctx allocation failure Patch series "mm/damon/{reclaim,lru_sort}… |
CVE-2026-53333 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: mm/mincore: handle non-swap entries before !CONFIG_SWAP guard mincore_swap() also fields… |
CVE-2026-53332 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remoteproc sta… |
CVE-2026-53331 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock During the SSR/PDR down notifica… |
CVE-2026-53330 | High | 7.1 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() [Why & How] The au… |
CVE-2026-53329 | High | 7.0 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_rese… |
CVE-2026-53328 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() A WARN fires whe… |
CVE-2026-53327 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: debugobjects: Do not fill_pool() if pi_blocked_on On RT enabled kernels, fill_pool() ends… |
CVE-2026-53326 | Medium | 5.5 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't call fill_pool() in early boot hardirq context When booting a debug P… |
CVE-2026-13603 | | 2026-07-01 | The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The in… | |
CVE-2026-8387 | Low | 2.4 | 2026-07-01 | A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile… |
CVE-2026-5120 | High | 8.1 | 2026-07-01 | A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another use… |
CVE-2026-53909 | Medium | 6.5 | 2026-07-01 | MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An auth… |
CVE-2026-53908 | Medium | 4.3 | 2026-07-01 | MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid u… |
CVE-2026-53907 | Medium | 5.4 | 2026-07-01 | MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application lo… |
CVE-2026-53906 | High | 8.2 | 2026-07-01 | MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename p… |
CVE-2026-53905 | High | 7.1 | 2026-07-01 | MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated… |
CVE-2026-53904 | High | 7.1 | 2026-07-01 | MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previous… |
CVE-2026-53903 | High | 8.1 | 2026-07-01 | MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint… |
CVE-2026-53902 | Medium | 6.5 | 2026-07-01 | MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can mo… |
CVE-2026-14198 | Critical | 9.1 | 2026-07-01 | @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underl… |
CVE-2026-14181 | High | 7.5 | 2026-07-01 | @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malform… |
CVE-2026-13323 | Medium | 4.1 | 2026-07-01 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Poli… |
CVE-2026-14258 | Medium | 6.5 | 2026-07-01 | A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Ne… |
CVE-2026-13228 | High | 8.8 | 2026-07-01 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up… |
CVE-2026-12142 | High | 7.2 | 2026-07-01 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all vers… |
CVE-2026-10095 | Medium | 6.4 | 2026-07-01 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1… |
CVE-2026-27435 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woffice… |
CVE-2026-13454 | Medium | 6.5 | 2026-07-01 | The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5… |
CVE-2026-12754 | Medium | 6.1 | 2026-07-01 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'layoutstyle' parameter in all versions… |
CVE-2026-56016 | Medium | 5.9 | 2026-07-01 | CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id fr… |
CVE-2026-50043 | High | 7.2 | 2026-07-01 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-A100/MB-A110. If this vulnerability is… |
CVE-2026-13733 | Medium | 6.4 | 2026-07-01 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and includi… |
CVE-2026-12732 | Medium | 6.4 | 2026-07-01 | The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and includ… |
CVE-2026-12577 | | 2026-07-01 | DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability. | |
CVE-2026-12576 | High | 7.5 | 2026-07-01 | DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability. |
CVE-2026-12575 | High | 7.5 | 2026-07-01 | DVP80ES3 with Improper Resource Shutdown or Release vulnerability. |
CVE-2026-12435 | Medium | 4.3 | 2026-07-01 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1… |
CVE-2026-12408 | Medium | 4.3 | 2026-07-01 | The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to… |
CVE-2026-12224 | High | 8.8 | 2026-07-01 | The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. Th… |
CVE-2026-12158 | High | 8.8 | 2026-07-01 | The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6… |
CVE-2026-11387 | Critical | 9.8 | 2026-07-01 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account… |
CVE-2026-10540 | Medium | 5.6 | 2026-07-01 | The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if creden… |
CVE-2026-10539 | Critical | 9.0 | 2026-07-01 | A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauth… |
CVE-2026-10538 | High | 8.0 | 2026-07-01 | Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Co… |
CVE-2026-10096 | Medium | 4.3 | 2026-07-01 | The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter du… |
CVE-2026-1239 | High | 7.5 | 2026-07-01 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization… |
CVE-2026-14193 | High | 7.5 | 2026-07-01 | DVP80ES300T with Improper Validation of Array Index Vulnerability |
CVE-2026-12579 | High | 7.4 | 2026-07-01 | AS228T with Authentication Bypass Vulnerability |
CVE-2026-11887 | Medium | 4.3 | 2026-07-01 | The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated use… |
CVE-2026-11883 | High | 7.2 | 2026-07-01 | The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker… |
CVE-2026-11880 | Low | 3.1 | 2026-07-01 | The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticate… |
CVE-2026-11823 | High | 7.5 | 2026-07-01 | The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmemb… |
CVE-2026-11794 | High | 8.1 | 2026-07-01 | The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user f… |
CVE-2026-11570 | Medium | 4.2 | 2026-07-01 | The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, lead… |
CVE-2026-11568 | High | 7.5 | 2026-07-01 | The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce pro… |
CVE-2026-11562 | Medium | 4.3 | 2026-07-01 | The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subs… |
CVE-2026-10750 | High | 8.1 | 2026-07-01 | The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenti… |
CVE-2026-9107 | Medium | 6.4 | 2026-07-01 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_component… |
CVE-2026-7840 | Critical | 9.8 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in… |
CVE-2026-7839 | Critical | 9.1 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when setting… |
CVE-2026-7838 | High | 8.8 | 2026-07-01 | UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/… |
CVE-2026-7831 | High | 7.6 | 2026-07-01 | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the… |
CVE-2026-7830 | High | 7.4 | 2026-07-01 | UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman ke… |
CVE-2026-7829 | High | 7.2 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, afte… |
CVE-2026-7828 | Medium | 5.3 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allo… |
CVE-2026-7517 | High | 7.2 | 2026-07-01 | The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in al… |
CVE-2026-6070 | Critical | 9.1 | 2026-07-01 | The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to in… |
CVE-2026-58519 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-58518 | Medium | 6.3 | 2026-07-01 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issu… |
CVE-2026-44042 | Low | 3.7 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:81… |
CVE-2026-44041 | Medium | 4.3 | 2026-07-01 | UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a… |