2026 CVEs (page 180)
Page 180 of 669 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78237 | High | 7.8 | 2026-08-26 | Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that r… |
CVE-2026-78236 | High | 8.8 | 2026-08-26 | An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communicat… |
CVE-2026-75977 | High | 8.8 | 2026-08-26 | The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. Th… |
CVE-2026-6178 | Medium | 6.4 | 2026-08-26 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4… |
CVE-2026-18884 | High | 7.5 | 2026-08-26 | The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and incl… |
CVE-2026-58108 | | 2026-08-26 | The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves th… | |
CVE-2026-3002 | Medium | 6.4 | 2026-08-26 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in… |
CVE-2026-18431 | Critical | 9.8 | 2026-08-26 | The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and… |
CVE-2026-18331 | High | 7.2 | 2026-08-26 | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-15366 | | 2026-08-26 | A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page | |
CVE-2026-15365 | | 2026-08-26 | A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app. | |
CVE-2026-79654 | Medium | 4.3 | 2026-08-26 | A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An… |
CVE-2026-78146 | Medium | 6.5 | 2026-08-26 | The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering tha… |
CVE-2026-77790 | Medium | 5.5 | 2026-08-26 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high priv… |
CVE-2026-77789 | Medium | 4.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting cust… |
CVE-2026-77758 | Medium | 5.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation s… |
CVE-2026-77757 | Medium | 5.4 | 2026-08-26 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference befor… |
CVE-2026-77754 | Medium | 5.3 | 2026-08-26 | The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated use… |
CVE-2026-77695 | Medium | 6.5 | 2026-08-26 | The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX action… |
CVE-2026-77694 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unaut… |
CVE-2026-77693 | High | 8.7 | 2026-08-26 | The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which pa… |
CVE-2026-75798 | Medium | 5.3 | 2026-08-26 | The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it… |
CVE-2026-75797 | High | 7.7 | 2026-08-26 | The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forw… |
CVE-2026-74930 | Medium | 4.3 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its R… |
CVE-2026-74929 | Medium | 5.4 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticat… |
CVE-2026-74928 | High | 7.5 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPre… |
CVE-2026-74851 | High | 7.2 | 2026-08-26 | The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author r… |
CVE-2026-58097 | High | 7.8 | 2026-08-26 | mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user… |
CVE-2026-58096 | High | 8.8 | 2026-08-26 | LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would tr… |
CVE-2026-58095 | High | 8.8 | 2026-08-26 | mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a… |
CVE-2026-58094 | High | 7.8 | 2026-08-26 | The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the… |
CVE-2026-58093 | High | 7.0 | 2026-08-26 | The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the s… |
CVE-2026-19760 | High | 7.2 | 2026-08-26 | The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and… |
CVE-2026-19718 | High | 8.1 | 2026-08-26 | The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin Wo… |
CVE-2026-19226 | Medium | 6.8 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which… |
CVE-2026-19220 | Low | 3.7 | 2026-08-26 | The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing u… |
CVE-2026-19094 | Medium | 5.3 | 2026-08-26 | The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may l… |
CVE-2026-16986 | Medium | 5.3 | 2026-08-26 | The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected cha… |
CVE-2026-16984 | Medium | 6.5 | 2026-08-26 | The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authoriza… |
CVE-2026-15203 | | 2026-08-26 | Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write ac… | |
CVE-2026-14550 | Medium | 5.3 | 2026-08-26 | The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly… |
CVE-2026-14216 | Medium | 6.5 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queu… |
CVE-2026-14212 | Medium | 4.7 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider accou… |
CVE-2026-13406 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbi… |
CVE-2026-13404 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonc… |
CVE-2026-13172 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowin… |
CVE-2026-9805 | Low | 2.7 | 2026-08-26 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. |
CVE-2026-80214 | | 2026-08-26 | LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server. | |
CVE-2026-80202 | High | 8.8 | 2026-08-26 | Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timeshe… |
CVE-2026-80201 | Low | 2.0 | 2026-08-26 | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() me… |
CVE-2026-80200 | Medium | 4.7 | 2026-08-26 | Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as r… |
CVE-2026-80199 | Low | 3.7 | 2026-08-26 | Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-… |
CVE-2026-80198 | High | 7.5 | 2026-08-26 | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary… |
CVE-2026-80197 | Medium | 4.3 | 2026-08-26 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to mani… |
CVE-2026-80196 | High | 7.5 | 2026-08-26 | Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signat… |
CVE-2026-80195 | Medium | 5.4 | 2026-08-26 | Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all… |
CVE-2026-80194 | Medium | 4.3 | 2026-08-26 | Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization gu… |
CVE-2026-80193 | High | 8.8 | 2026-08-26 | Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with vie… |
CVE-2026-80192 | High | 8.1 | 2026-08-26 | @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When… |
CVE-2026-80191 | High | 7.5 | 2026-08-26 | GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in app… |
CVE-2026-80189 | Medium | 6.5 | 2026-08-26 | LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens e… |
CVE-2026-76149 | Medium | 4.4 | 2026-08-26 | CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file. |
CVE-2026-76148 | High | 7.8 | 2026-08-26 | CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product. |
CVE-2026-73335 | Medium | 5.3 | 2026-08-26 | Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the u… |
CVE-2026-58092 | High | 8.1 | 2026-08-26 | In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array… |
CVE-2026-58091 | High | 7.8 | 2026-08-26 | The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list… |
CVE-2026-58090 | High | 7.8 | 2026-08-26 | The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some err… |
CVE-2026-58089 | High | 7.8 | 2026-08-26 | When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check mea… |
CVE-2026-57171 | High | 7.7 | 2026-08-26 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 throug… |
CVE-2026-57170 | High | 7.8 | 2026-08-26 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3… |
CVE-2026-54467 | High | 7.0 | 2026-08-26 | On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, suppli… |
CVE-2026-52776 | | 2026-08-26 | Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurity… | |
CVE-2026-29988 | High | 7.6 | 2026-08-26 | A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions… |
CVE-2026-19632 | Critical | 9.8 | 2026-08-26 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2026-80138 | Critical | 9.8 | 2026-08-25 | ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attacke… |
CVE-2026-79912 | High | 8.3 | 2026-08-25 | A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Pe… |
CVE-2026-79911 | Critical | 10.0 | 2026-08-25 | A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/… |
CVE-2026-70665 | Medium | 4.2 | 2026-08-25 | Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client… |
CVE-2026-55805 | Medium | 5.4 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects… |
CVE-2026-54757 | High | 7.8 | 2026-08-25 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 throug… |
CVE-2026-44476 | | 2026-08-25 | Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public… | |
CVE-2026-41707 | High | 7.4 | 2026-08-25 | Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based repl… |
CVE-2026-18985 | High | 8.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2… |
CVE-2026-18261 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*. |
CVE-2026-18260 | Medium | 5.7 | 2026-08-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page… |
CVE-2026-18259 | High | 7.5 | 2026-08-25 | Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to… |
CVE-2026-16646 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*. |
CVE-2026-16645 | Critical | 9.1 | 2026-08-25 | Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe -… |
CVE-2026-16644 | Critical | 9.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0. |
CVE-2026-16643 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*. |
CVE-2026-16642 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*. |
CVE-2026-16641 | Critical | 9.8 | 2026-08-25 | Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*. |
CVE-2026-16640 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This… |
CVE-2026-16639 | Critical | 9.8 | 2026-08-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue a… |
CVE-2026-16638 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affect… |
CVE-2026-15917 | Medium | 4.7 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-15916 | Medium | 4.2 | 2026-08-25 | Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0… |
CVE-2026-15088 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*. |
CVE-2026-80186 | High | 7.6 | 2026-08-25 | A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a speciall… |
CVE-2026-80185 | Medium | 5.7 | 2026-08-25 | BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML pars… |