2026 CVEs (page 189)
Page 189 of 471 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12616 | | 2026-06-29 | The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into thr… | |
CVE-2026-11979 | High | 7.8 | 2026-06-29 | libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user… |
CVE-2026-41992 | High | 7.5 | 2026-06-29 | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decom… |
CVE-2026-41991 | Medium | 4.7 | 2026-06-29 | GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH… |
CVE-2026-13564 | High | 8.8 | 2026-06-29 | A vulnerability was found in Edimax EW-7478APC 1.04. Affected is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request H… |
CVE-2026-13563 | High | 8.8 | 2026-06-29 | A vulnerability has been found in Edimax EW-7478APC 1.04. This impacts the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Reque… |
CVE-2026-13562 | High | 8.8 | 2026-06-29 | A flaw has been found in Edimax EW-7478APC 1.04. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component POST Requ… |
CVE-2026-13561 | Medium | 6.3 | 2026-06-29 | A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted element is the function formiNICbasic of the file /goform/formiNICbasic of the component P… |
CVE-2026-13560 | Medium | 6.3 | 2026-06-29 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the com… |
CVE-2026-13559 | High | 7.3 | 2026-06-29 | A weakness has been identified in code-projects Real State Services 1.0. Impacted is an unknown function of the file /single-list_sale.php?action=add. Executin… |
CVE-2026-13558 | Low | 3.5 | 2026-06-29 | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of t… |
CVE-2026-57346 | High | 7.1 | 2026-06-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue affect… |
CVE-2026-25707 | High | 8.8 | 2026-06-29 | A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories t… |
CVE-2026-13601 | High | 7.1 | 2026-06-29 | A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can ope… |
CVE-2026-13557 | Medium | 4.3 | 2026-06-29 | A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. This vulnerability affects unknown code of the file /admin/mod_room/controll… |
CVE-2026-13556 | Medium | 4.3 | 2026-06-29 | A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?act… |
CVE-2026-13555 | High | 7.3 | 2026-06-29 | A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/mod_users… |
CVE-2026-13554 | Medium | 4.3 | 2026-06-29 | A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admi… |
CVE-2026-13553 | High | 7.3 | 2026-06-29 | A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/mod_amenities/controller.php?actio… |
CVE-2026-13552 | High | 7.3 | 2026-06-29 | A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/mod_amenities/controller.p… |
CVE-2026-9267 | | 2026-06-29 | Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function… | |
CVE-2026-57966 | Medium | 4.4 | 2026-06-29 | A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on t… |
CVE-2026-57965 | Medium | 5.1 | 2026-06-29 | A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerabi… |
CVE-2026-57676 | Medium | 4.3 | 2026-06-29 | Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22078 | High | 7.3 | 2026-06-29 | Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC cha… |
CVE-2026-13595 | Medium | 6.8 | 2026-06-29 | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a ra… |
CVE-2026-13551 | High | 7.3 | 2026-06-29 | A security vulnerability has been detected in itsourcecode Baptism Information Management System 1.0. This affects an unknown function of the file /editBaptism… |
CVE-2026-13550 | High | 7.3 | 2026-06-29 | A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.p… |
CVE-2026-13549 | Medium | 5.4 | 2026-06-29 | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/con… |
CVE-2026-13548 | Medium | 6.3 | 2026-06-29 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /doctortimings.php. The manipulation… |
CVE-2026-13547 | High | 7.3 | 2026-06-29 | A vulnerability was determined in Hanwang e-Face General Management Platform 6.3.5.4. This issue affects some unknown processing of the file /manage/resourceUp… |
CVE-2026-13546 | High | 7.3 | 2026-06-29 | A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Perfo… |
CVE-2026-13545 | High | 8.8 | 2026-06-29 | A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler… |
CVE-2026-9676 | Medium | 4.3 | 2026-06-29 | The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated… |
CVE-2026-13544 | Medium | 6.3 | 2026-06-29 | A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipula… |
CVE-2026-13543 | Medium | 5.6 | 2026-06-29 | A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/h… |
CVE-2026-13542 | Medium | 6.3 | 2026-06-29 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /doctorprofile.php. The… |
CVE-2026-13541 | Medium | 6.3 | 2026-06-29 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /doctorchangepassword.php. Executin… |
CVE-2026-13540 | Medium | 6.3 | 2026-06-29 | A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/s… |
CVE-2026-13539 | High | 8.8 | 2026-06-29 | A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the… |
CVE-2026-10083 | High | 7.5 | 2026-06-29 | The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Si… |
CVE-2026-53325 | Medium | 5.5 | 2026-06-29 | In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference w… |
CVE-2026-13538 | Medium | 6.3 | 2026-06-29 | A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the… |
CVE-2026-13537 | Medium | 4.3 | 2026-06-29 | A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request fo… |
CVE-2026-13536 | Medium | 4.3 | 2026-06-29 | A vulnerability has been found in GotoHTTP up to 10.2. This issue affects some unknown processing of the file /reg.12x. The manipulation of the argument sn lea… |
CVE-2026-13535 | Medium | 6.3 | 2026-06-29 | A flaw has been found in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function GetFileInfo of the file hrsystem/application/m… |
CVE-2026-13534 | Medium | 5.0 | 2026-06-29 | A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/main/services/memory/MemoryService.ts of t… |
CVE-2026-13533 | Medium | 5.3 | 2026-06-29 | A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/conf… |
CVE-2026-13532 | Medium | 6.3 | 2026-06-29 | A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /departme… |
CVE-2026-13531 | Medium | 6.3 | 2026-06-29 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /department.php. The manipulati… |
CVE-2026-13530 | Medium | 6.3 | 2026-06-29 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /appointmentdetail.php of the compo… |
CVE-2026-13529 | Medium | 5.6 | 2026-06-29 | A vulnerability was determined in YzmCMS up to 7.5. This affects an unknown function of the file /application/install/index.php. Executing a manipulation of th… |
CVE-2026-13528 | High | 7.3 | 2026-06-29 | A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPath of the fil… |
CVE-2026-13527 | High | 7.3 | 2026-06-29 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /preview4.php… |
CVE-2026-13526 | High | 7.3 | 2026-06-29 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_class.php. This manipulation o… |
CVE-2026-13525 | Medium | 6.3 | 2026-06-29 | A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/E… |
CVE-2026-13524 | Medium | 5.6 | 2026-06-29 | A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6. This vulnerability affects unknown code of the file src/main/services/mcp/oau… |
CVE-2026-13523 | Low | 3.3 | 2026-06-29 | A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Execu… |
CVE-2026-13522 | Medium | 4.3 | 2026-06-29 | A security flaw has been discovered in Investintech SlimPDFReader up to 2.0.14. Affected by this issue is the function SlimPDFReader!Investintech::PCV::TeighaD… |
CVE-2026-13521 | High | 7.3 | 2026-06-29 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-13520 | Medium | 6.3 | 2026-06-29 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /appointmentapproval.php of the comp… |
CVE-2026-13519 | High | 8.8 | 2026-06-29 | A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of… |
CVE-2026-13518 | High | 8.8 | 2026-06-29 | A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the arg… |
CVE-2026-13517 | High | 8.8 | 2026-06-29 | A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executing a manipulat… |
CVE-2026-13516 | High | 8.8 | 2026-06-29 | A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performin… |
CVE-2026-13515 | High | 8.8 | 2026-06-29 | A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. Such ma… |
CVE-2026-13514 | Low | 2.4 | 2026-06-29 | A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml… |
CVE-2026-13513 | Medium | 5.0 | 2026-06-29 | A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects the function SegmentId::getCacheKey in the library src/VectorI… |
CVE-2026-13512 | Medium | 6.3 | 2026-06-28 | A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/s… |
CVE-2026-13511 | Low | 3.1 | 2026-06-28 | A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/s… |
CVE-2026-13510 | Low | 3.7 | 2026-06-28 | A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security… |
CVE-2026-13509 | Medium | 6.3 | 2026-06-28 | A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/c… |
CVE-2026-13508 | Medium | 5.5 | 2026-06-28 | A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversat… |
CVE-2026-13507 | Medium | 5.0 | 2026-06-28 | A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_t… |
CVE-2026-49048 | Critical | 9.8 | 2026-06-28 | The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter in… |
CVE-2026-13504 | Low | 3.5 | 2026-06-28 | A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component M… |
CVE-2026-13503 | Medium | 5.3 | 2026-06-28 | A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/… |
CVE-2026-13502 | Medium | 4.5 | 2026-06-28 | A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/an… |
CVE-2026-13501 | Medium | 5.3 | 2026-06-28 | A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr… |
CVE-2026-13500 | High | 7.3 | 2026-06-28 | A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of… |
CVE-2026-13499 | Medium | 4.3 | 2026-06-28 | A security flaw has been discovered in yashpokharna2555 restaurent-management-system. This impacts an unknown function of the file login_register.php of the co… |
CVE-2026-13498 | High | 7.3 | 2026-06-28 | A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unknown function of the file /forgotpassword.php of the compon… |
CVE-2026-13497 | Medium | 6.3 | 2026-06-28 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /appointment.php. This m… |
CVE-2026-13496 | Medium | 6.3 | 2026-06-28 | A vulnerability was found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /ajaxmedicine.php. The manipu… |
CVE-2026-13495 | Medium | 4.7 | 2026-06-28 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminprofile.php. The manipulation… |
CVE-2026-13493 | Low | 3.1 | 2026-06-28 | A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of… |
CVE-2026-13491 | Low | 3.7 | 2026-06-28 | A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_… |
CVE-2026-13490 | Low | 3.7 | 2026-06-28 | A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/documen… |
CVE-2026-13489 | Low | 3.1 | 2026-06-28 | A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the compo… |
CVE-2026-13488 | High | 7.3 | 2026-06-28 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-13487 | High | 7.3 | 2026-06-28 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulat… |
CVE-2026-13486 | High | 7.3 | 2026-06-28 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Execu… |
CVE-2026-13485 | High | 7.3 | 2026-06-28 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a mani… |
CVE-2026-13484 | Medium | 5.0 | 2026-06-28 | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experimen… |
CVE-2026-13483 | Low | 3.1 | 2026-06-28 | A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the file application/security/encryption.py of… |
CVE-2026-13482 | Low | 3.7 | 2026-06-28 | A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component U… |
CVE-2026-10646 | High | 7.4 | 2026-06-28 | Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo… |
CVE-2026-10644 | Medium | 4.2 | 2026-06-28 | The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchron… |
CVE-2026-10593 | Medium | 6.5 | 2026-06-28 | The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subs… |
CVE-2026-58058 | Medium | 6.5 | 2026-06-28 | Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer ad… |