2026 CVEs (page 186)
Page 186 of 471 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11712 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. |
CVE-2026-11708 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. |
CVE-2026-11595 | Medium | 4.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help s… |
CVE-2026-11546 | High | 7.1 | 2026-06-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 featur… |
CVE-2026-10564 | High | 8.2 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py… |
CVE-2026-10560 | High | 8.2 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated atta… |
CVE-2026-10546 | High | 7.1 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/… |
CVE-2026-10140 | Critical | 9.6 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenti… |
CVE-2026-10134 | Critical | 10.0 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, messa… |
CVE-2026-10129 | High | 8.5 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticat… |
CVE-2026-10109 | Critical | 9.8 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling. |
CVE-2026-58138 | Critical | 9.8 | 2026-06-30 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS comm… |
CVE-2026-10513 | High | 7.2 | 2026-06-30 | The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' au… |
CVE-2026-9263 | Medium | 6.5 | 2026-06-30 | The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start s… |
CVE-2026-8864 | | 2026-06-30 | The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this p… | |
CVE-2026-58377 | High | 8.1 | 2026-06-30 | JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and… |
CVE-2026-58376 | High | 7.6 | 2026-06-30 | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database c… |
CVE-2026-58375 | High | 7.5 | 2026-06-30 | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTo… |
CVE-2026-58373 | Medium | 4.3 | 2026-06-30 | CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quali… |
CVE-2026-58372 | High | 8.1 | 2026-06-30 | SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write… |
CVE-2026-58371 | Low | 3.1 | 2026-06-30 | SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson hel… |
CVE-2026-58370 | High | 8.1 | 2026-06-30 | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from t… |
CVE-2026-58369 | Medium | 5.3 | 2026-06-30 | Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the LookupOrg handler unconditionally de… |
CVE-2026-58176 | Medium | 6.5 | 2026-06-30 | RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permissi… |
CVE-2026-58174 | Medium | 6.5 | 2026-06-30 | Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting it… |
CVE-2026-58173 | Medium | 6.5 | 2026-06-30 | Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying… |
CVE-2026-58172 | Critical | 9.1 | 2026-06-30 | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restr… |
CVE-2026-58171 | Medium | 4.2 | 2026-06-30 | Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in ru… |
CVE-2026-58170 | High | 8.3 | 2026-06-30 | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitizat… |
CVE-2026-58169 | High | 7.5 | 2026-06-30 | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by e… |
CVE-2026-58168 | High | 8.8 | 2026-06-30 | DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allo… |
CVE-2026-58167 | Medium | 6.5 | 2026-06-30 | Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passw… |
CVE-2026-58166 | Critical | 9.1 | 2026-06-30 | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete… |
CVE-2026-58165 | High | 8.8 | 2026-06-30 | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained… |
CVE-2026-49451 | High | 7.5 | 2026-06-30 | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents f… |
CVE-2026-10655 | Medium | 6.5 | 2026-06-30 | The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file descriptor directly from the calling thread im… |
CVE-2026-10654 | Low | 3.1 | 2026-06-30 | A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c) mishandles a simultaneous bidirectional session dis… |
CVE-2026-10653 | Medium | 6.4 | 2026-06-30 | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the star… |
CVE-2026-10652 | Medium | 4.8 | 2026-06-30 | Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_answer(), which validated only the fixed RR header (type, c… |
CVE-2026-48315 | Critical | 9.3 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48314 | Medium | 6.5 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-48313 | Critical | 9.3 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-48307 | High | 8.8 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabil… |
CVE-2026-48286 | Critical | 10.0 | 2026-06-30 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code… |
CVE-2026-48285 | High | 8.6 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypa… |
CVE-2026-48283 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary… |
CVE-2026-48282 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-48281 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48277 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48276 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary… |
CVE-2026-44948 | | 2026-06-30 | A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0… | |
CVE-2026-13455 | Medium | 4.3 | 2026-06-30 | PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_outpu… |
CVE-2026-4360 | Medium | 5.3 | 2026-06-30 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrust… |
CVE-2026-48192 | Medium | 5.4 | 2026-06-30 | A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions)… |
CVE-2026-44949 | | 2026-06-30 | A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0… | |
CVE-2026-44947 | | 2026-06-30 | A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users… | |
CVE-2026-27957 | High | 8.8 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection… |
CVE-2026-27956 | Medium | 4.3 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}… |
CVE-2026-27955 | Medium | 6.6 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker() helper wraps… |
CVE-2026-27883 | Medium | 5.0 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid… |
CVE-2026-27882 | Medium | 4.8 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a… |
CVE-2026-27881 | Medium | 5.0 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/deployments/{uuid}` i… |
CVE-2026-35098 | | 2026-06-30 | KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This… | |
CVE-2026-35097 | | 2026-06-30 | KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This… | |
CVE-2026-35096 | | 2026-06-30 | KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attacker can craft a malic… | |
CVE-2026-35095 | | 2026-06-30 | KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its value remains unchang… | |
CVE-2026-14241 | Critical | 9.8 | 2026-06-30 | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-14178 | Medium | 5.9 | 2026-06-30 | openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parser_cxt.nls_fmt_str。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan… |
CVE-2026-8655 | Critical | 9.8 | 2026-06-30 | Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScal… |
CVE-2026-8452 | Critical | 9.8 | 2026-06-30 | Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is conf… |
CVE-2026-8451 | High | 7.5 | 2026-06-30 | Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML I… |
CVE-2026-8403 | Medium | 6.1 | 2026-06-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Eksagate Electronic Engineering and Computer Industry Tra… |
CVE-2026-6556 | Critical | 9.1 | 2026-06-30 | @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount path… |
CVE-2026-58374 | Medium | 6.5 | 2026-06-30 | In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthent… |
CVE-2026-58116 | Critical | 9.8 | 2026-06-30 | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplyin… |
CVE-2026-58016 | High | 7.5 | 2026-06-30 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus… |
CVE-2026-58015 | Medium | 5.9 | 2026-06-30 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context param… |
CVE-2026-58014 | High | 7.3 | 2026-06-30 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with a… |
CVE-2026-58013 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length… |
CVE-2026-58012 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacemen… |
CVE-2026-58011 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDat… |
CVE-2026-58010 | Medium | 6.5 | 2026-06-30 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padd… |
CVE-2026-53433 | High | 7.5 | 2026-06-30 | fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repea… |
CVE-2026-53432 | High | 7.5 | 2026-06-30 | fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is… |
CVE-2026-4629 | Medium | 6.5 | 2026-06-30 | A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper int… |
CVE-2026-44946 | High | 7.4 | 2026-06-30 | A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially… |
CVE-2026-14209 | Medium | 4.3 | 2026-06-30 | A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Adm… |
CVE-2026-13474 | High | 7.5 | 2026-06-30 | Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual ser… |
CVE-2026-12388 | Medium | 6.5 | 2026-06-30 | A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to… |
CVE-2026-10817 | High | 7.5 | 2026-06-30 | Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associate… |
CVE-2026-10816 | High | 7.5 | 2026-06-30 | Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is ena… |
CVE-2026-8402 | Critical | 9.8 | 2026-06-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Tra… |
CVE-2026-57082 | Medium | 5.9 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE (Message Stream Encryption)… |
CVE-2026-57081 | High | 7.5 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dict… |
CVE-2026-57080 | High | 7.5 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _proc… |
CVE-2026-57079 | Medium | 5.3 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent valida… |
CVE-2026-53692 | | 2026-06-30 | Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. Because MD5 is a cryptographically broken algorithm and lacks salting… | |
CVE-2026-53691 | | 2026-06-30 | An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated attackers to achieve Remote Code Execution via the POST "/admin/inde… | |
CVE-2026-53690 | | 2026-06-30 | An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in the POST "/admin/index.php" login endpoint. The application… | |
CVE-2026-41053 | High | 8.8 | 2026-06-30 | Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any log… |