2026 CVEs (page 184)
Page 184 of 679 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81527 | Medium | 6.5 | 2026-08-27 | A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and qu… |
CVE-2026-81526 | Medium | 6.5 | 2026-08-27 | The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server… |
CVE-2026-81525 | High | 8.1 | 2026-08-27 | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct… |
CVE-2026-81524 | Medium | 5.4 | 2026-08-27 | A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the dri… |
CVE-2026-81523 | Medium | 4.4 | 2026-08-27 | A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted with… |
CVE-2026-81522 | High | 8.1 | 2026-08-27 | A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An applicatio… |
CVE-2026-81521 | Medium | 6.5 | 2026-08-27 | The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping… |
CVE-2026-77438 | High | 7.5 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the… |
CVE-2026-76640 | High | 7.5 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated p… |
CVE-2026-76639 | High | 8.8 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitra… |
CVE-2026-75889 | High | 7.7 | 2026-08-27 | Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify… |
CVE-2026-74820 | | 2026-08-27 | ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticate… | |
CVE-2026-6876 | | 2026-08-27 | ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated… | |
CVE-2026-66353 | | 2026-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value… | |
CVE-2026-65931 | | 2026-08-27 | LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticat… | |
CVE-2026-59324 | High | 8.2 | 2026-08-27 | When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessage… |
CVE-2026-59322 | Medium | 6.3 | 2026-08-27 | The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte pay… |
CVE-2026-59321 | Medium | 4.2 | 2026-08-27 | A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. th… |
CVE-2026-59320 | Medium | 6.5 | 2026-08-27 | When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one lin… |
CVE-2026-59319 | Medium | 4.3 | 2026-08-27 | RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape()… |
CVE-2026-59317 | Medium | 6.5 | 2026-08-27 | DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new Bi… |
CVE-2026-59316 | High | 8.2 | 2026-08-27 | Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker… |
CVE-2026-59315 | Medium | 5.3 | 2026-08-27 | The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0… |
CVE-2026-59314 | Low | 3.7 | 2026-08-27 | Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file… |
CVE-2026-59313 | Critical | 9.8 | 2026-08-27 | Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7… |
CVE-2026-59311 | Medium | 6.8 | 2026-08-27 | A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer… |
CVE-2026-59307 | High | 8.0 | 2026-08-27 | An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bea… |
CVE-2026-59306 | Low | 3.1 | 2026-08-27 | Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Strea… |
CVE-2026-59305 | Low | 3.1 | 2026-08-27 | Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4… |
CVE-2026-59304 | Low | 3.1 | 2026-08-27 | Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Str… |
CVE-2026-59303 | Low | 3.1 | 2026-08-27 | Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud S… |
CVE-2026-59302 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4… |
CVE-2026-59301 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Funct… |
CVE-2026-59300 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Functio… |
CVE-2026-59299 | Low | 3.1 | 2026-08-27 | Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Sprin… |
CVE-2026-59298 | Low | 3.1 | 2026-08-27 | Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud… |
CVE-2026-59297 | Low | 3.1 | 2026-08-27 | Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function… |
CVE-2026-59294 | Medium | 5.9 | 2026-08-27 | ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and… |
CVE-2026-59293 | Medium | 6.6 | 2026-08-27 | Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vuln… |
CVE-2026-59292 | Low | 3.2 | 2026-08-27 | PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.pr… |
CVE-2026-59291 | Low | 2.0 | 2026-08-27 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring C… |
CVE-2026-59289 | High | 7.5 | 2026-08-27 | Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying reposito… |
CVE-2026-59288 | High | 7.4 | 2026-08-27 | The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the… |
CVE-2026-59287 | Medium | 5.9 | 2026-08-27 | Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring f… |
CVE-2026-59286 | High | 8.1 | 2026-08-27 | The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject ma… |
CVE-2026-59285 | High | 8.1 | 2026-08-27 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4 |
CVE-2026-59284 | High | 7.6 | 2026-08-27 | There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4… |
CVE-2026-59283 | Critical | 9.1 | 2026-08-27 | Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL… |
CVE-2026-59282 | High | 7.5 | 2026-08-27 | Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a D… |
CVE-2026-59281 | Medium | 6.1 | 2026-08-27 | Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Er… |
CVE-2026-59277 | Low | 3.7 | 2026-08-27 | Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a gi… |
CVE-2026-59276 | Medium | 5.9 | 2026-08-27 | Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison… |
CVE-2026-55758 | | 2026-08-27 | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src… | |
CVE-2026-54732 | Medium | 6.5 | 2026-08-27 | libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileN… |
CVE-2026-54721 | High | 8.8 | 2026-08-27 | Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject… |
CVE-2026-54718 | High | 7.2 | 2026-08-27 | Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the… |
CVE-2026-54713 | Low | 3.7 | 2026-08-27 | CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBe… |
CVE-2026-54687 | Critical | 9.8 | 2026-08-27 | n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database f… |
CVE-2026-53580 | High | 8.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a no… |
CVE-2026-53579 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML onl… | |
CVE-2026-53578 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML onl… | |
CVE-2026-48996 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize… | |
CVE-2026-47727 | | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the share… | |
CVE-2026-37198 | High | 7.5 | 2026-08-27 | An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet. |
CVE-2026-37073 | Medium | 5.3 | 2026-08-27 | Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configu… |
CVE-2026-37072 | Critical | 9.8 | 2026-08-27 | Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. |
CVE-2026-37071 | Critical | 9.8 | 2026-08-27 | Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker wit… |
CVE-2026-37070 | Medium | 6.5 | 2026-08-27 | Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by… |
CVE-2026-37069 | Medium | 5.3 | 2026-08-27 | Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthentica… |
CVE-2026-37068 | High | 8.1 | 2026-08-27 | Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role o… |
CVE-2026-37067 | Medium | 5.3 | 2026-08-27 | Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all appli… |
CVE-2026-37066 | Medium | 6.5 | 2026-08-27 | Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authentic… |
CVE-2026-37065 | Critical | 9.1 | 2026-08-27 | Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=. |
CVE-2026-37064 | Medium | 5.3 | 2026-08-27 | User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via… |
CVE-2026-37012 | High | 7.5 | 2026-08-27 | A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credenti… |
CVE-2026-37009 | Medium | 6.5 | 2026-08-27 | A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query… |
CVE-2026-37007 | Critical | 9.8 | 2026-08-27 | A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the… |
CVE-2026-37006 | Critical | 9.8 | 2026-08-27 | A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via maliciou… |
CVE-2026-37004 | Critical | 9.8 | 2026-08-27 | BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands… |
CVE-2026-37003 | Critical | 9.8 | 2026-08-27 | Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, L… |
CVE-2026-36102 | High | 7.2 | 2026-08-27 | An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmi… |
CVE-2026-35869 | Critical | 9.8 | 2026-08-27 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs d… |
CVE-2026-35868 | Critical | 9.8 | 2026-08-27 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4. This flaw occu… |
CVE-2026-34620 | Medium | 5.5 | 2026-08-27 | DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker coul… |
CVE-2026-34616 | Medium | 5.5 | 2026-08-27 | DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-30612 | Critical | 9.8 | 2026-08-27 | An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to… |
CVE-2026-25250 | Medium | 6.0 | 2026-08-27 | EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable." |
CVE-2026-19092 | Critical | 9.8 | 2026-08-27 | The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticat… |
CVE-2026-18886 | | 2026-08-27 | ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauth… | |
CVE-2026-18885 | | 2026-08-27 | ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated… | |
CVE-2026-18374 | Medium | 4.9 | 2026-08-27 | Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier m… |
CVE-2026-10036 | High | 8.8 | 2026-08-27 | SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml ch… |
CVE-2026-81827 | | 2026-08-27 | Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation… | |
CVE-2026-81826 | | 2026-08-27 | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already posses… | |
CVE-2026-81820 | | 2026-08-27 | Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; *… | |
CVE-2026-81819 | | 2026-08-27 | Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying… | |
CVE-2026-81818 | | 2026-08-27 | Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an org… | |
CVE-2026-81817 | | 2026-08-27 | Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The rout… | |
CVE-2026-81735 | Critical | 10.0 | 2026-08-27 | startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpSe… |
CVE-2026-81727 | High | 7.1 | 2026-08-27 | NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows a… |