2026 CVEs (page 181)
Page 181 of 669 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44476 | | 2026-08-25 | Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public… | |
CVE-2026-41707 | High | 7.4 | 2026-08-25 | Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based repl… |
CVE-2026-18985 | High | 8.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2… |
CVE-2026-18261 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*. |
CVE-2026-18260 | Medium | 5.7 | 2026-08-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page… |
CVE-2026-18259 | High | 7.5 | 2026-08-25 | Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to… |
CVE-2026-16646 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*. |
CVE-2026-16645 | Critical | 9.1 | 2026-08-25 | Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe -… |
CVE-2026-16644 | Critical | 9.1 | 2026-08-25 | Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0. |
CVE-2026-16643 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*. |
CVE-2026-16642 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*. |
CVE-2026-16641 | Critical | 9.8 | 2026-08-25 | Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*. |
CVE-2026-16640 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This… |
CVE-2026-16639 | Critical | 9.8 | 2026-08-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue a… |
CVE-2026-16638 | Medium | 6.1 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affect… |
CVE-2026-15917 | Medium | 4.7 | 2026-08-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi… |
CVE-2026-15916 | Medium | 4.2 | 2026-08-25 | Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0… |
CVE-2026-15088 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*. |
CVE-2026-80186 | High | 7.6 | 2026-08-25 | A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a speciall… |
CVE-2026-80185 | Medium | 5.7 | 2026-08-25 | BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML pars… |
CVE-2026-80184 | | 2026-08-25 | In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be s… | |
CVE-2026-80182 | | 2026-08-25 | In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-live… | |
CVE-2026-79845 | High | 7.3 | 2026-08-25 | A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php… |
CVE-2026-79804 | High | 7.3 | 2026-08-25 | A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown funct… |
CVE-2026-78655 | Critical | 9.1 | 2026-08-25 | Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge… |
CVE-2026-78619 | Critical | 9.8 | 2026-08-25 | Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user ide… |
CVE-2026-73180 | Medium | 6.8 | 2026-08-25 | Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket con… |
CVE-2026-68763 | High | 7.5 | 2026-08-25 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue aff… |
CVE-2026-68569 | High | 8.1 | 2026-08-25 | Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if t… |
CVE-2026-68525 | Critical | 9.1 | 2026-08-25 | Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access… |
CVE-2026-66422 | High | 8.1 | 2026-08-25 | Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additio… |
CVE-2026-65927 | High | 7.5 | 2026-08-25 | Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather tha… |
CVE-2026-65905 | Critical | 9.8 | 2026-08-25 | Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a… |
CVE-2026-65637 | Critical | 9.8 | 2026-08-25 | Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11… |
CVE-2026-65183 | High | 8.1 | 2026-08-25 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access… |
CVE-2026-65182 | Critical | 9.1 | 2026-08-25 | Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specif… |
CVE-2026-63404 | | 2026-08-25 | Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file… | |
CVE-2026-63403 | | 2026-08-25 | Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a… | |
CVE-2026-62865 | | 2026-08-25 | Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of lo… | |
CVE-2026-62862 | | 2026-08-25 | Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vuln… | |
CVE-2026-62861 | | 2026-08-25 | TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make t… | |
CVE-2026-38474 | Medium | 5.4 | 2026-08-25 | GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which… |
CVE-2026-38473 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authent… |
CVE-2026-38472 | Medium | 6.1 | 2026-08-25 | A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to… |
CVE-2026-38470 | Medium | 4.3 | 2026-08-25 | A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivil… |
CVE-2026-38469 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote aut… |
CVE-2026-38468 | Medium | 4.3 | 2026-08-25 | A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remot… |
CVE-2026-38467 | Medium | 5.4 | 2026-08-25 | A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated… |
CVE-2026-38466 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… |
CVE-2026-38465 | Medium | 5.4 | 2026-08-25 | A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… |
CVE-2026-32637 | | 2026-08-25 | Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who co… | |
CVE-2026-80104 | Critical | 9.8 | 2026-08-25 | DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/… |
CVE-2026-80101 | Medium | 4.4 | 2026-08-25 | A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line pa… |
CVE-2026-79793 | Medium | 4.3 | 2026-08-25 | A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit… |
CVE-2026-79792 | Medium | 5.6 | 2026-08-25 | A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py… |
CVE-2026-79293 | Medium | 6.5 | 2026-08-25 | Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-79292 | High | 8.3 | 2026-08-25 | Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execut… |
CVE-2026-79291 | Medium | 6.5 | 2026-08-25 | Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium se… |
CVE-2026-79290 | Critical | 9.6 | 2026-08-25 | Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-79289 | Low | 3.1 | 2026-08-25 | Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the render… |
CVE-2026-79288 | Medium | 6.5 | 2026-08-25 | Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a cra… |
CVE-2026-79287 | Medium | 5.3 | 2026-08-25 | Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chr… |
CVE-2026-79286 | High | 7.4 | 2026-08-25 | Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outsid… |
CVE-2026-79285 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML… |
CVE-2026-79284 | Medium | 4.3 | 2026-08-25 | UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI e… |
CVE-2026-79283 | Medium | 5.4 | 2026-08-25 | UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
CVE-2026-79282 | Critical | 9.6 | 2026-08-25 | Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a cra… |
CVE-2026-79276 | Medium | 4.3 | 2026-08-25 | Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system ac… |
CVE-2026-79275 | Critical | 9.6 | 2026-08-25 | Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-79274 | Medium | 4.3 | 2026-08-25 | Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-79273 | Medium | 4.3 | 2026-08-25 | Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin poli… |
CVE-2026-79272 | Low | 3.1 | 2026-08-25 | Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cros… |
CVE-2026-79271 | Medium | 6.5 | 2026-08-25 | Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a c… |
CVE-2026-79270 | Medium | 6.5 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |
CVE-2026-79269 | Medium | 4.3 | 2026-08-25 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML pa… |
CVE-2026-79267 | Medium | 4.3 | 2026-08-25 | Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin polic… |
CVE-2026-79266 | High | 8.8 | 2026-08-25 | Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the… |
CVE-2026-79265 | Medium | 5.3 | 2026-08-25 | Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-79264 | Medium | 4.3 | 2026-08-25 | Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page… |
CVE-2026-79263 | High | 8.1 | 2026-08-25 | Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network… |
CVE-2026-79262 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
CVE-2026-79261 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Controls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chr… |
CVE-2026-79260 | Medium | 6.5 | 2026-08-25 | Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web o… |
CVE-2026-79259 | Medium | 4.3 | 2026-08-25 | Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-79258 | Medium | 6.5 | 2026-08-25 | Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data vi… |
CVE-2026-79257 | Critical | 9.6 | 2026-08-25 | Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-79256 | High | 8.3 | 2026-08-25 | Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-79255 | Low | 3.1 | 2026-08-25 | Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web or… |
CVE-2026-79254 | Medium | 4.3 | 2026-08-25 | Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictio… |
CVE-2026-79253 | Medium | 6.5 | 2026-08-25 | Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to leak sens… |
CVE-2026-79252 | Medium | 4.3 | 2026-08-25 | Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-79251 | Medium | 4.3 | 2026-08-25 | Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HT… |
CVE-2026-79250 | Medium | 5.4 | 2026-08-25 | UI misrepresentation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium se… |
CVE-2026-79249 | Medium | 6.5 | 2026-08-25 | Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted file. (Chromium sec… |
CVE-2026-79248 | Medium | 4.3 | 2026-08-25 | Incorrect authorization in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-79247 | High | 8.3 | 2026-08-25 | Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execut… |
CVE-2026-79246 | Medium | 6.5 | 2026-08-25 | Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Ch… |
CVE-2026-79245 | High | 7.7 | 2026-08-25 | Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the renderer process to execute arbitrary code outsid… |
CVE-2026-79244 | High | 8.8 | 2026-08-25 | Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML p… |
CVE-2026-79243 | Medium | 6.5 | 2026-08-25 | Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proce… |