2026 CVEs (page 198)
Page 198 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47626 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful explo… |
CVE-2026-47624 | Medium | 6.0 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability… |
CVE-2026-24263 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful e… |
CVE-2026-24262 | High | 8.2 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful explo… |
CVE-2026-24225 | Medium | 6.0 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read. A successful exploit of… |
CVE-2026-24170 | High | 8.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by… |
CVE-2026-24169 | High | 8.0 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a spe… |
CVE-2026-24168 | Medium | 6.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection… |
CVE-2026-24167 | Medium | 6.8 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafte… |
CVE-2026-24166 | Medium | 5.1 | 2026-08-25 | NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract infor… |
CVE-2026-19913 | High | 7.5 | 2026-08-25 | The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedL… |
CVE-2026-19912 | Critical | 9.8 | 2026-08-25 | The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanit… |
CVE-2026-18445 | Medium | 6.6 | 2026-08-25 | There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW. This may result in information disclosure or… |
CVE-2026-18444 | Medium | 6.6 | 2026-08-25 | There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This may result in info… |
CVE-2026-16234 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-16233 | High | 7.8 | 2026-08-25 | There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful… |
CVE-2026-13478 | Medium | 5.5 | 2026-08-25 | The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_f… |
CVE-2026-13217 | Medium | 5.9 | 2026-08-25 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_m… |
CVE-2026-13216 | Medium | 6.1 | 2026-08-25 | The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the device-sup… |
CVE-2026-79785 | Medium | 5.9 | 2026-08-25 | X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py built a context with… |
CVE-2026-79784 | High | 8.8 | 2026-08-25 | Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class… |
CVE-2026-79783 | Low | 3.6 | 2026-08-25 | rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/s… |
CVE-2026-79782 | Low | 3.1 | 2026-08-25 | rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can inter… |
CVE-2026-79781 | Medium | 6.5 | 2026-08-25 | rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in… |
CVE-2026-79780 | Medium | 5.3 | 2026-08-25 | rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved acro… |
CVE-2026-79779 | Medium | 5.3 | 2026-08-25 | rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over pl… |
CVE-2026-79778 | Medium | 5.3 | 2026-08-25 | rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transp… |
CVE-2026-79777 | Low | 2.7 | 2026-08-25 | rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, modu… |
CVE-2026-79776 | Medium | 5.3 | 2026-08-25 | rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can a… |
CVE-2026-79775 | Medium | 6.5 | 2026-08-25 | rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which… |
CVE-2026-79774 | High | 8.4 | 2026-08-25 | Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated b… |
CVE-2026-79773 | Medium | 4.9 | 2026-08-25 | Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets… |
CVE-2026-79772 | Medium | 5.3 | 2026-08-25 | Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of… |
CVE-2026-79771 | Medium | 5.3 | 2026-08-25 | Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can… |
CVE-2026-79770 | High | 7.5 | 2026-08-25 | Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identif… |
CVE-2026-79769 | Medium | 5.5 | 2026-08-25 | Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind N… |
CVE-2026-79676 | Medium | 5.9 | 2026-08-25 | NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.paths… |
CVE-2026-79675 | Critical | 9.8 | 2026-08-25 | NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous J… |
CVE-2026-79674 | High | 8.2 | 2026-08-25 | NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended… |
CVE-2026-70550 | Medium | 6.5 | 2026-08-25 | An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadat… |
CVE-2026-70548 | Low | 3.5 | 2026-08-25 | Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency. |
CVE-2026-55640 | Critical | 9.1 | 2026-08-25 | Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpo… |
CVE-2026-55582 | High | 8.4 | 2026-08-25 | mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while… |
CVE-2026-55581 | High | 8.4 | 2026-08-25 | mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash i… |
CVE-2026-55580 | | 2026-08-25 | mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and… | |
CVE-2026-55546 | Critical | 9.8 | 2026-08-25 | QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-contr… |
CVE-2026-55539 | High | 8.6 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable… |
CVE-2026-55536 | Critical | 9.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the… |
CVE-2026-55533 | High | 8.2 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT a… |
CVE-2026-55532 | High | 7.6 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the atta… |
CVE-2026-79717 | Medium | 6.4 | 2026-08-25 | A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace mana… |
CVE-2026-70551 | High | 8.5 | 2026-08-25 | A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL. |
CVE-2026-69104 | High | 7.6 | 2026-08-25 | An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unautho… |
CVE-2026-55624 | | 2026-08-25 | MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blo… | |
CVE-2026-55541 | | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app()… | |
CVE-2026-55540 | High | 7.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the wo… |
CVE-2026-55538 | High | 7.3 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but _create_agents_app() does not authentic… |
CVE-2026-55537 | High | 7.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.g… |
CVE-2026-55535 | Medium | 6.8 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind th… |
CVE-2026-55534 | High | 8.6 | 2026-08-25 | PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authent… |
CVE-2026-55531 | Medium | 6.5 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize req… |
CVE-2026-55530 | Medium | 6.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools… |
CVE-2026-55529 | Medium | 6.9 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so… |
CVE-2026-55528 | High | 8.2 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not chec… |
CVE-2026-55527 | High | 7.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller su… |
CVE-2026-55526 | High | 8.5 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_pag… |
CVE-2026-16599 | | 2026-08-25 | GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line… | |
CVE-2026-16286 | Critical | 9.8 | 2026-08-25 | Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Sof… |
CVE-2026-15310 | | 2026-08-25 | When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possi… | |
CVE-2026-79655 | High | 7.8 | 2026-08-25 | A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By… |
CVE-2026-79623 | Medium | 6.3 | 2026-08-25 | A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of… |
CVE-2026-79622 | High | 7.3 | 2026-08-25 | A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-… |
CVE-2026-55525 | High | 7.5 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses h… |
CVE-2026-79406 | Medium | 4.3 | 2026-08-25 | A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/upd… |
CVE-2026-78887 | Low | 3.7 | 2026-08-25 | A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Execut… |
CVE-2026-78886 | Low | 3.7 | 2026-08-25 | A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controll… |
CVE-2026-78885 | Medium | 5.6 | 2026-08-25 | A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService… |
CVE-2026-78581 | Medium | 4.2 | 2026-08-25 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constr… |
CVE-2026-77998 | | 2026-08-25 | Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On –… | |
CVE-2026-75803 | Critical | 9.1 | 2026-08-25 | Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the… |
CVE-2026-63076 | High | 7.5 | 2026-08-25 | Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before t… |
CVE-2026-63075 | High | 7.5 | 2026-08-25 | Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC… |
CVE-2026-63074 | Medium | 5.9 | 2026-08-25 | Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (fo… |
CVE-2026-63073 | Critical | 9.8 | 2026-08-25 | Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Im… |
CVE-2026-63072 | High | 7.5 | 2026-08-25 | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can wr… |
CVE-2026-57863 | High | 8.8 | 2026-08-25 | Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files o… |
CVE-2026-54874 | High | 7.5 | 2026-08-25 | Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requ… |
CVE-2026-18798 | High | 7.5 | 2026-08-25 | Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads… |
CVE-2026-14457 | High | 7.5 | 2026-08-25 | Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) confi… |
CVE-2026-79673 | Medium | 6.5 | 2026-08-25 | Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An at… |
CVE-2026-79672 | Medium | 5.5 | 2026-08-25 | Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full… |
CVE-2026-79671 | Medium | 5.5 | 2026-08-25 | Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates li… |
CVE-2026-79670 | Medium | 4.8 | 2026-08-25 | Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied heade… |
CVE-2026-79669 | Medium | 4.3 | 2026-08-25 | Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers ca… |
CVE-2026-79668 | Medium | 5.3 | 2026-08-25 | Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment eng… |
CVE-2026-79667 | High | 7.6 | 2026-08-25 | Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privil… |
CVE-2026-79666 | Medium | 6.5 | 2026-08-25 | Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers wit… |
CVE-2026-79665 | High | 8.8 | 2026-08-25 | Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non… |
CVE-2026-79664 | High | 7.4 | 2026-08-25 | Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after… |
CVE-2026-79663 | Medium | 4.8 | 2026-08-25 | Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML es… |