2026 CVEs (page 202)

Page 202 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.

All CVEs published in 2026 — newest first (page 202 of 681)
CVESeverityScorePublishedSummary
CVE-2026-60093Medium5.52026-08-24Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15…
CVE-2026-59230Medium6.52026-08-24Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0…
CVE-2026-19685High7.12026-08-24NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix…
CVE-2026-183492026-08-24Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.
CVE-2026-154692026-08-24The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.  A shared RS…
CVE-2026-784162026-08-24Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel…
CVE-2026-76071Critical9.82026-08-24Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved st…
CVE-2026-76070Critical9.82026-08-24Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved st…
CVE-2026-71366High7.72026-08-24A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notificat…
CVE-2026-71364High7.22026-08-24A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining…
CVE-2026-67204Medium5.42026-08-24BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to ma…
CVE-2026-21752High7.52026-08-24HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting…
CVE-2026-13343Medium5.32026-08-24The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_en…
CVE-2026-13212High8.82026-08-24The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virti…
CVE-2026-125562026-08-24Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead t…
CVE-2026-125552026-08-24Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead t…
CVE-2026-125542026-08-24Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead t…
CVE-2026-9728Medium6.42026-08-24The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out…
CVE-2026-78414High8.02026-08-24Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-ne…
CVE-2026-783912026-08-24RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names o…
CVE-2026-783872026-08-24RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authen…
CVE-2026-760552026-08-24Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor a…
CVE-2026-760542026-08-24Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the sc…
CVE-2026-65053Medium6.12026-08-24Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble…
CVE-2026-39915High8.12026-08-24TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embed…
CVE-2026-39914Medium6.52026-08-24TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dash…
CVE-2026-21755Medium5.32026-08-24HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denia…
CVE-2026-19874Critical9.12026-08-24A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked…
CVE-2026-783862026-08-24RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware g…
CVE-2026-783852026-08-24RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and p…
CVE-2026-783812026-08-24RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates…
CVE-2026-783802026-08-24RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channel…
CVE-2026-783782026-08-24Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into…
CVE-2026-78376High8.82026-08-24A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruptio…
CVE-2026-783722026-08-24RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or other…
CVE-2026-783702026-08-24RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information inten…
CVE-2026-783692026-08-24RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for…
CVE-2026-78367High7.02026-08-24A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes…
CVE-2026-78250Medium4.32026-08-24A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipul…
CVE-2026-78248High7.32026-08-24A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action…
CVE-2026-779952026-08-24Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak…
CVE-2026-76847High8.82026-08-24act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that bac…
CVE-2026-76845Medium6.52026-08-24adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the st…
CVE-2026-76844High7.42026-08-24zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it poi…
CVE-2026-76843High7.82026-08-24The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib…
CVE-2026-76842High8.22026-08-24The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural i…
CVE-2026-76841High8.82026-08-24Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader…
CVE-2026-76840Critical9.62026-08-24RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer…
CVE-2026-67602Critical9.12026-08-24phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploitin…
CVE-2026-59568Critical9.12026-08-24Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability…
CVE-2026-59567High8.82026-08-24Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute…
CVE-2026-59566High8.42026-08-24A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS.
CVE-2026-59565High8.82026-08-24A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows.
CVE-2026-59564Critical9.12026-08-24An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.
CVE-2026-30512High7.82026-08-24A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5…
CVE-2026-21751High7.42026-08-24HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread crede…
CVE-2026-17033Medium6.82026-08-24An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL…
CVE-2026-783652026-08-24Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and…
CVE-2026-78247High7.32026-08-24A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?…
CVE-2026-21759Medium4.32026-08-24HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  Although no sensitive information (e.g…
CVE-2026-21756High7.22026-08-24HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken…
CVE-2026-78323Medium6.52026-08-24A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certifica…
CVE-2026-78291Medium5.32026-08-24Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
CVE-2026-78290Medium6.52026-08-24Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
CVE-2026-78280Medium4.32026-08-24Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
CVE-2026-78279Medium5.42026-08-24Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
CVE-2026-78278Medium5.32026-08-24Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78277Medium4.92026-08-24Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
CVE-2026-78272Medium5.42026-08-24Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
CVE-2026-78270High7.62026-08-24Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
CVE-2026-78269Medium6.42026-08-24Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
CVE-2026-78258Medium5.32026-08-24Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
CVE-2026-78246High7.32026-08-24A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of th…
CVE-2026-60172026-08-24Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to…
CVE-2026-66671High8.12026-08-24Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
CVE-2026-66670High8.12026-08-24Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
CVE-2026-66650Critical9.82026-08-24Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
CVE-2026-66648Critical9.82026-08-24Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
CVE-2026-66623High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
CVE-2026-66610High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.
CVE-2026-66599High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
CVE-2026-66587Critical9.82026-08-24Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
CVE-2026-66585High7.52026-08-24Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
CVE-2026-66584High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
CVE-2026-32558Critical9.82026-08-24Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
CVE-2026-32551Critical9.32026-08-24Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue…
CVE-2026-32478High8.52026-08-24Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.
CVE-2026-32477High8.62026-08-24Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
CVE-2026-32476High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
CVE-2026-32471High8.52026-08-24Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.
CVE-2026-28190High7.12026-08-24Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
CVE-2026-28171High8.62026-08-24Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
CVE-2026-28167High7.52026-08-24Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
CVE-2026-28166High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.
CVE-2026-28165Critical9.82026-08-24Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
CVE-2026-28162High7.12026-08-24Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
CVE-2026-28153High7.52026-08-24Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.
CVE-2026-28152High8.12026-08-24Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
CVE-2026-28151High8.12026-08-24Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-783372026-08-24Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the…