2026 CVEs (page 197)
Page 197 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74932 | High | 7.5 | 2026-08-25 | The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the page… |
CVE-2026-68515 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3… |
CVE-2026-68514 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through… |
CVE-2026-68513 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 a… |
CVE-2026-66153 | High | 7.0 | 2026-08-25 | The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths. |
CVE-2026-66152 | High | 8.8 | 2026-08-25 | A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root. |
CVE-2026-65367 | Medium | 5.5 | 2026-08-25 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5. An app… |
CVE-2026-64705 | Medium | 5.5 | 2026-08-25 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macO… |
CVE-2026-59981 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10… |
CVE-2026-55099 | High | 7.5 | 2026-08-25 | icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/… |
CVE-2026-45019 | High | 7.2 | 2026-08-25 | Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp… |
CVE-2026-45018 | Critical | 9.8 | 2026-08-25 | Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp… |
CVE-2026-43670 | High | 8.8 | 2026-08-25 | A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18… |
CVE-2026-43657 | Low | 3.3 | 2026-08-25 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate insta… |
CVE-2026-80050 | Medium | 6.5 | 2026-08-25 | ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to st… |
CVE-2026-80049 | High | 8.8 | 2026-08-25 | Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised iden… |
CVE-2026-79788 | High | 7.1 | 2026-08-25 | In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that i… |
CVE-2026-79787 | Critical | 9.8 | 2026-08-25 | Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user ident… |
CVE-2026-79786 | High | 7.1 | 2026-08-25 | Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to… |
CVE-2026-78379 | High | 8.1 | 2026-08-25 | Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execut… |
CVE-2026-65979 | | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4… | |
CVE-2026-62986 | Medium | 4.3 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through… |
CVE-2026-61555 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11… |
CVE-2026-59985 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through… |
CVE-2026-55663 | Medium | 5.6 | 2026-08-25 | mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasou… |
CVE-2026-55620 | High | 7.5 | 2026-08-25 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0… |
CVE-2026-55619 | Medium | 5.3 | 2026-08-25 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0… |
CVE-2026-55618 | Medium | 6.5 | 2026-08-25 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0… |
CVE-2026-55609 | High | 7.1 | 2026-08-25 | sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1… |
CVE-2026-80051 | | 2026-08-25 | github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceStrin… | |
CVE-2026-79992 | High | 7.8 | 2026-08-25 | A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP conca… |
CVE-2026-76198 | Medium | 5.5 | 2026-08-25 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this… |
CVE-2026-76197 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that co… |
CVE-2026-76195 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that co… |
CVE-2026-76193 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-76189 | Medium | 6.2 | 2026-08-25 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-75770 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-75769 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-75768 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A… |
CVE-2026-75767 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-75766 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-75752 | Medium | 5.5 | 2026-08-25 | Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vul… |
CVE-2026-75750 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-75749 | High | 7.8 | 2026-08-25 | Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-71564 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-71444 | Medium | 6.2 | 2026-08-25 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-71443 | High | 7.5 | 2026-08-25 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could expl… |
CVE-2026-71442 | High | 7.5 | 2026-08-25 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-71441 | Medium | 5.5 | 2026-08-25 | Illustrator is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability… |
CVE-2026-71399 | High | 7.8 | 2026-08-25 | Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exp… |
CVE-2026-71382 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-71360 | High | 7.5 | 2026-08-25 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-59984 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.1.0 through… |
CVE-2026-59983 | Medium | 5.5 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11… |
CVE-2026-59982 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11… |
CVE-2026-55637 | | 2026-08-25 | genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp l… | |
CVE-2026-55419 | Medium | 5.3 | 2026-08-25 | Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by t… |
CVE-2026-48433 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-48432 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-48431 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-48430 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-48429 | Medium | 5.5 | 2026-08-25 | Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit… |
CVE-2026-48428 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-48427 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-48426 | High | 7.8 | 2026-08-25 | Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-48425 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-48424 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-48423 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-48422 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-48421 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-48420 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-48419 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-48418 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-48417 | High | 7.8 | 2026-08-25 | Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-26211 | Medium | 4.8 | 2026-08-25 | Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in th… |
CVE-2026-75498 | High | 7.2 | 2026-08-25 | Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a craft… |
CVE-2026-75497 | High | 7.2 | 2026-08-25 | Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a craft… |
CVE-2026-75496 | High | 7.2 | 2026-08-25 | Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote… |
CVE-2026-64204 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64203 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64202 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-64201 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-59189 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 t… |
CVE-2026-59187 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through… |
CVE-2026-59186 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3… |
CVE-2026-59184 | High | 7.1 | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 t… |
CVE-2026-55585 | High | 8.8 | 2026-08-25 | QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production… |
CVE-2026-55571 | High | 8.2 | 2026-08-25 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount se… |
CVE-2026-55557 | | 2026-08-25 | browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(sa… | |
CVE-2026-55553 | High | 7.5 | 2026-08-25 | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows r… |
CVE-2026-47626 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful explo… |
CVE-2026-47624 | Medium | 6.0 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability… |
CVE-2026-24263 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful e… |
CVE-2026-24262 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful explo… |
CVE-2026-24225 | Medium | 6.0 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read. A successful exploit of… |
CVE-2026-24170 | High | 8.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by… |
CVE-2026-24169 | High | 8.0 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a spe… |
CVE-2026-24168 | Medium | 6.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection… |
CVE-2026-24167 | Medium | 6.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafte… |
CVE-2026-24166 | Medium | 5.1 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract infor… |