2026 CVEs (page 188)
Page 188 of 471 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13762 | Critical | 9.8 | 2026-06-29 | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspecti… |
CVE-2026-13593 | Medium | 6.5 | 2026-06-29 | CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory leak when proce… |
CVE-2026-58000 | High | 8.8 | 2026-06-29 | luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta paramet… |
CVE-2026-57999 | High | 8.8 | 2026-06-29 | luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitra… |
CVE-2026-53428 | | 2026-06-29 | Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of service through unbounded m… | |
CVE-2026-53427 | | 2026-06-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scri… | |
CVE-2026-13757 | Medium | 6.2 | 2026-06-29 | A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a… |
CVE-2026-57960 | Medium | 6.5 | 2026-06-29 | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists inc… |
CVE-2026-57959 | Medium | 5.9 | 2026-06-29 | Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob inc… |
CVE-2026-57958 | Medium | 6.1 | 2026-06-29 | Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenti… |
CVE-2026-57957 | Medium | 4.7 | 2026-06-29 | Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform… |
CVE-2026-57956 | Medium | 6.4 | 2026-06-29 | SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a… |
CVE-2026-57955 | High | 8.5 | 2026-06-29 | SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-enco… |
CVE-2026-57954 | Medium | 4.3 | 2026-06-29 | Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort colle… |
CVE-2026-57953 | Medium | 5.4 | 2026-06-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations b… |
CVE-2026-57952 | Medium | 5.3 | 2026-06-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook… |
CVE-2026-57951 | Medium | 6.5 | 2026-06-29 | Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operatio… |
CVE-2026-57950 | High | 8.1 | 2026-06-29 | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp… |
CVE-2026-57949 | Medium | 6.5 | 2026-06-29 | ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/… |
CVE-2026-57948 | Medium | 6.8 | 2026-06-29 | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to miss… |
CVE-2026-57947 | High | 8.5 | 2026-06-29 | Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register in… |
CVE-2026-57946 | Low | 3.7 | 2026-06-29 | Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist content… |
CVE-2026-57945 | Medium | 4.3 | 2026-06-29 | PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile info… |
CVE-2026-57943 | Medium | 5.9 | 2026-06-29 | LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant th… |
CVE-2026-57942 | Medium | 5.3 | 2026-06-29 | LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated a… |
CVE-2026-56783 | Medium | 6.5 | 2026-06-29 | Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth cre… |
CVE-2026-56782 | Critical | 9.8 | 2026-06-29 | Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access… |
CVE-2026-56781 | Medium | 5.3 | 2026-06-29 | Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supply… |
CVE-2026-56780 | High | 7.5 | 2026-06-29 | Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administ… |
CVE-2026-56285 | High | 8.6 | 2026-06-29 | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated at… |
CVE-2026-36848 | High | 7.5 | 2026-06-29 | Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem. |
CVE-2026-13592 | High | 7.3 | 2026-06-29 | A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of… |
CVE-2026-11720 | Critical | 9.1 | 2026-06-29 | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder subst… |
CVE-2026-13752 | Medium | 6.0 | 2026-06-29 | Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying cra… |
CVE-2026-13751 | Medium | 4.1 | 2026-06-29 | Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !sourc… |
CVE-2026-13591 | Medium | 5.0 | 2026-06-29 | A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the compon… |
CVE-2026-13590 | Medium | 5.6 | 2026-06-29 | A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusL… |
CVE-2026-13589 | Medium | 5.6 | 2026-06-29 | A vulnerability was identified in seladb PcapPlusPlus 25.05. This affects the function pcpp::TelnetLayer::getSubCommand of the file Packet++/src/TelnetLayer.cp… |
CVE-2026-13588 | Medium | 5.6 | 2026-06-29 | A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file… |
CVE-2026-12912 | High | 7.3 | 2026-06-29 | A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occ… |
CVE-2026-9105 | Medium | 6.5 | 2026-06-29 | An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker ca… |
CVE-2026-41052 | High | 8.8 | 2026-06-29 | Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6… |
CVE-2026-13750 | Medium | 5.5 | 2026-06-29 | Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug… |
CVE-2026-13749 | High | 8.8 | 2026-06-29 | Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during… |
CVE-2026-13748 | Medium | 6.3 | 2026-06-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowfla… |
CVE-2026-13746 | Low | 3.6 | 2026-06-29 | Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by su… |
CVE-2026-13744 | High | 8.3 | 2026-06-29 | Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repositor… |
CVE-2026-13742 | | 2026-06-29 | Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. An attacker could p… | |
CVE-2026-13587 | Low | 3.7 | 2026-06-29 | A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component Li… |
CVE-2026-13583 | High | 8.8 | 2026-06-29 | A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Reques… |
CVE-2026-13582 | High | 8.8 | 2026-06-29 | A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Reques… |
CVE-2026-13581 | Medium | 6.3 | 2026-06-29 | A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the comp… |
CVE-2026-13580 | High | 8.8 | 2026-06-29 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affects the function formQoS of the file /goform/formQoS of the component POST Reque… |
CVE-2026-13437 | Medium | 6.5 | 2026-06-29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Age… |
CVE-2026-57341 | Medium | 6.5 | 2026-06-29 | Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions. |
CVE-2026-57340 | Medium | 6.5 | 2026-06-29 | Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. |
CVE-2026-57339 | Medium | 6.5 | 2026-06-29 | Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions. |
CVE-2026-57338 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. |
CVE-2026-57337 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions. |
CVE-2026-57336 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions. |
CVE-2026-57335 | Medium | 6.5 | 2026-06-29 | Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions. |
CVE-2026-57334 | Medium | 6.5 | 2026-06-29 | Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. |
CVE-2026-57333 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions. |
CVE-2026-57332 | High | 7.1 | 2026-06-29 | Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions. |
CVE-2026-57331 | Critical | 9.9 | 2026-06-29 | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions. |
CVE-2026-57330 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions. |
CVE-2026-57329 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions. |
CVE-2026-57328 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. |
CVE-2026-57327 | Medium | 6.3 | 2026-06-29 | Subscriber Broken Access Control in MainWP <= 6.1.1 versions. |
CVE-2026-57326 | Medium | 6.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. |
CVE-2026-57320 | High | 7.1 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions. |
CVE-2026-56290 | Critical | 9.8 | 2026-06-29 | Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an un… |
CVE-2026-56124 | High | 7.5 | 2026-06-29 | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploa… |
CVE-2026-55844 | High | 7.5 | 2026-06-29 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID all… |
CVE-2026-55607 | High | 8.8 | 2026-06-29 | Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to… |
CVE-2026-49049 | High | 7.5 | 2026-06-29 | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and upda… |
CVE-2026-46406 | Medium | 6.1 | 2026-06-29 | Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/… |
CVE-2026-13579 | Medium | 6.3 | 2026-06-29 | A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientchangep… |
CVE-2026-13578 | Medium | 6.3 | 2026-06-29 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /pat… |
CVE-2026-13574 | Low | 3.3 | 2026-06-29 | A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst… |
CVE-2026-13573 | Low | 3.3 | 2026-06-29 | A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of t… |
CVE-2026-13572 | Medium | 6.3 | 2026-06-29 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /insertbillingrecord.php… |
CVE-2026-13571 | Medium | 5.3 | 2026-06-29 | A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipul… |
CVE-2026-56457 | Medium | 4.3 | 2026-06-29 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with… |
CVE-2026-54371 | High | 7.1 | 2026-06-29 | attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges… |
CVE-2026-54370 | Medium | 6.3 | 2026-06-29 | acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by re… |
CVE-2026-54369 | High | 7.1 | 2026-06-29 | acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file()… |
CVE-2026-40524 | High | 8.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated dire… |
CVE-2026-40523 | High | 8.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC p… |
CVE-2026-40522 | High | 7.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitr… |
CVE-2026-40521 | High | 8.8 | 2026-06-29 | FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary… |
CVE-2026-13676 | High | 7.5 | 2026-06-29 | fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that… |
CVE-2026-13570 | Low | 3.5 | 2026-06-29 | A vulnerability was detected in SourceCodester Inventory Management System 1.0. Impacted is an unknown function of the file /api/users_handler.php of the compo… |
CVE-2026-13569 | Medium | 4.7 | 2026-06-29 | A security vulnerability has been detected in weng-xianhu EyouCMS up to 1.7.1. This issue affects some unknown processing of the file /index.php of the compone… |
CVE-2026-13568 | High | 7.3 | 2026-06-29 | A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of… |
CVE-2026-13567 | Medium | 4.3 | 2026-06-29 | A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component PO… |
CVE-2026-13566 | High | 7.3 | 2026-06-29 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /previ… |
CVE-2026-13565 | High | 7.3 | 2026-06-29 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-13165 | | 2026-06-29 | SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputSt… | |
CVE-2026-12856 | High | 8.8 | 2026-06-29 | A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown conte… |