2026 CVEs (page 193)
Page 193 of 471 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57877 | High | 8.6 | 2026-06-26 | An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by imprope… |
CVE-2026-57876 | High | 7.5 | 2026-06-26 | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused… |
CVE-2026-57875 | High | 7.5 | 2026-06-26 | An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in GeoVision GV-LPC2011 and GV-LP… |
CVE-2026-57874 | High | 7.5 | 2026-06-26 | An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is… |
CVE-2026-57873 | High | 7.5 | 2026-06-26 | An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerab… |
CVE-2026-57872 | High | 7.5 | 2026-06-26 | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is cau… |
CVE-2026-49486 | High | 7.5 | 2026-06-26 | The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was… |
CVE-2026-2053 | High | 8.3 | 2026-06-26 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within t… |
CVE-2026-8380 | Medium | 6.5 | 2026-06-26 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing au… |
CVE-2026-10835 | High | 7.7 | 2026-06-26 | The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in… |
CVE-2026-10823 | High | 7.5 | 2026-06-26 | The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query p… |
CVE-2026-8797 | | 2026-06-26 | An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access to the product, arbitrary code could be… | |
CVE-2026-8661 | Medium | 4.8 | 2026-06-26 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers… |
CVE-2026-50745 | Medium | 6.1 | 2026-06-26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best pra… |
CVE-2026-50744 | Medium | 4.3 | 2026-06-26 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in th… |
CVE-2026-50742 | Medium | 5.4 | 2026-06-26 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused… |
CVE-2026-50741 | High | 8.8 | 2026-06-26 | Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a dis… |
CVE-2026-50740 | Medium | 5.4 | 2026-06-26 | A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could expl… |
CVE-2026-50739 | Medium | 4.3 | 2026-06-26 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers throug… |
CVE-2026-48936 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerab… |
CVE-2026-48935 | Low | 3.3 | 2026-06-26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnera… |
CVE-2026-48934 | Medium | 4.3 | 2026-06-26 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **… |
CVE-2026-48933 | High | 7.5 | 2026-06-26 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all su… |
CVE-2026-48930 | Critical | 9.8 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings… |
CVE-2026-48928 | Medium | 5.4 | 2026-06-26 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release… |
CVE-2026-48619 | High | 7.5 | 2026-06-26 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This… |
CVE-2026-48618 | Medium | 6.5 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver a… |
CVE-2026-48615 | High | 7.5 | 2026-06-26 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in th… |
CVE-2026-13226 | Medium | 6.5 | 2026-06-26 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versio… |
CVE-2026-9222 | High | 8.1 | 2026-06-26 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from th… |
CVE-2026-9221 | High | 7.5 | 2026-06-26 | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communicatio… |
CVE-2026-9220 | High | 7.5 | 2026-06-26 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES ke… |
CVE-2026-9219 | Medium | 6.5 | 2026-06-26 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lack… |
CVE-2026-43920 | | 2026-06-26 | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling… | |
CVE-2026-13322 | Low | 3.8 | 2026-06-26 | A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input in… |
CVE-2026-13318 | Medium | 6.4 | 2026-06-26 | A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInst… |
CVE-2026-13218 | Medium | 4.2 | 2026-06-26 | A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and… |
CVE-2026-13083 | Medium | 6.9 | 2026-06-26 | A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker wit… |
CVE-2026-12993 | Medium | 6.5 | 2026-06-26 | A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or… |
CVE-2026-40941 | Medium | 6.5 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which al… |
CVE-2026-40084 | Medium | 6.5 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file… |
CVE-2026-40083 | High | 7.2 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in man… |
CVE-2026-40082 | Medium | 5.4 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Sess… |
CVE-2026-40080 | Medium | 6.1 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather… |
CVE-2026-8720 | High | 7.5 | 2026-06-25 | wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. W… |
CVE-2026-7532 | High | 7.5 | 2026-06-25 | iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certi… |
CVE-2026-7511 | High | 7.5 | 2026-06-25 | PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to b… |
CVE-2026-6331 | High | 7.5 | 2026-06-25 | HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibilit… |
CVE-2026-6330 | Medium | 6.5 | 2026-06-25 | The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA… |
CVE-2026-6329 | Medium | 6.5 | 2026-06-25 | PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted… |
CVE-2026-6325 | High | 7.5 | 2026-06-25 | Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer. |
CVE-2026-6092 | Medium | 5.3 | 2026-06-25 | When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC. |
CVE-2026-55962 | Medium | 6.5 | 2026-06-25 | TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and Cert… |
CVE-2026-54479 | High | 7.3 | 2026-06-25 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifi… |
CVE-2026-50176 | High | 7.5 | 2026-06-25 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-44622 | Medium | 6.5 | 2026-06-25 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-40702 | Critical | 9.4 | 2026-06-25 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weaknes… |
CVE-2026-22879 | High | 8.1 | 2026-06-25 | vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability |
CVE-2026-13283 | High | 7.5 | 2026-06-25 | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-13282 | Medium | 6.8 | 2026-06-25 | Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially exploit heap corruption via physical acc… |
CVE-2026-13281 | High | 8.3 | 2026-06-25 | Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-12992 | High | 7.4 | 2026-06-25 | A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VA… |
CVE-2026-12975 | High | 8.5 | 2026-06-25 | A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or dis… |
CVE-2026-11800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials t… |
CVE-2026-11703 | High | 7.5 | 2026-06-25 | Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached sessio… |
CVE-2026-10098 | Medium | 5.3 | 2026-06-25 | OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial t… |
CVE-2026-6731 | High | 7.5 | 2026-06-25 | X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name cons… |
CVE-2026-6681 | Medium | 5.3 | 2026-06-25 | The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer… |
CVE-2026-6679 | High | 7.5 | 2026-06-25 | A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an intege… |
CVE-2026-6678 | Medium | 5.3 | 2026-06-25 | Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption. |
CVE-2026-6450 | Medium | 5.3 | 2026-06-25 | A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled cri… |
CVE-2026-6412 | Medium | 4.3 | 2026-06-25 | Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing. |
CVE-2026-56445 | Critical | 9.1 | 2026-06-25 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowin… |
CVE-2026-38640 | High | 7.5 | 2026-06-25 | A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted str… |
CVE-2026-38637 | High | 7.5 | 2026-06-25 | An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-37452 | High | 7.5 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSIAPService.ex… |
CVE-2026-12473 | High | 8.2 | 2026-06-25 | Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authenticatio… |
CVE-2026-7531 | Critical | 9.8 | 2026-06-25 | Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a… |
CVE-2026-57522 | Low | 3.5 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled val… |
CVE-2026-57521 | Medium | 4.3 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing dat… |
CVE-2026-57520 | High | 7.1 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Adm… |
CVE-2026-55964 | Medium | 5.3 | 2026-06-25 | Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key… |
CVE-2026-55960 | High | 7.5 | 2026-06-25 | Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelat… |
CVE-2026-55958 | High | 7.5 | 2026-06-25 | Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag (MSGBAG_SIZE) sets… |
CVE-2026-46602 | High | 7.5 | 2026-06-25 | The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbou… |
CVE-2026-46601 | High | 7.5 | 2026-06-25 | The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. |
CVE-2026-37454 | High | 7.5 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryp… |
CVE-2026-37453 | High | 7.5 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSI_SERVICE_2 p… |
CVE-2026-37149 | High | 7.7 | 2026-06-25 | GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/… |
CVE-2026-2299 | Medium | 4.2 | 2026-06-25 | The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a… |
CVE-2026-12340 | High | 7.5 | 2026-06-25 | Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier com… |
CVE-2026-11310 | High | 7.5 | 2026-06-25 | X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (O… |
CVE-2026-10592 | Medium | 5.3 | 2026-06-25 | Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by t… |
CVE-2026-10512 | High | 7.5 | 2026-06-25 | The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reduction, so the computed result may not be fully r… |
CVE-2026-10097 | High | 7.5 | 2026-06-25 | wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check… |
CVE-2026-57700 | Critical | 10.0 | 2026-06-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through… |
CVE-2026-56790 | High | 7.3 | 2026-06-25 | CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() function in analyzer/pgn.c that allows remot… |
CVE-2026-56789 | Medium | 6.5 | 2026-06-25 | RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruptio… |
CVE-2026-56788 | Medium | 4.4 | 2026-06-25 | RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attacke… |
CVE-2026-56787 | Medium | 6.5 | 2026-06-25 | RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to tr… |