2026 CVEs (page 203)
Page 203 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78245 | High | 7.3 | 2026-08-24 | A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the compon… |
CVE-2026-78244 | High | 7.3 | 2026-08-24 | A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Pe… |
CVE-2026-76172 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serializatio… |
CVE-2026-59295 | Medium | 5.9 | 2026-08-24 | It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak. … |
CVE-2026-10618 | Medium | 5.4 | 2026-08-24 | Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in ma… |
CVE-2026-10582 | High | 7.4 | 2026-08-24 | Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPUR… |
CVE-2026-78317 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-78316 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-78315 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-78314 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-75975 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an… |
CVE-2026-75931 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference… |
CVE-2026-75899 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authori… |
CVE-2026-66897 | Critical | 9.9 | 2026-08-24 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image… |
CVE-2026-78321 | | 2026-08-24 | The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's interna… | |
CVE-2026-78306 | | 2026-08-24 | DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration paramet… | |
CVE-2026-78255 | | 2026-08-24 | The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames… | |
CVE-2026-77994 | | 2026-08-24 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection… | |
CVE-2026-77993 | | 2026-08-24 | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscon… | |
CVE-2026-8173 | Medium | 5.3 | 2026-08-24 | The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy… |
CVE-2026-78202 | High | 7.3 | 2026-08-24 | A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argu… |
CVE-2026-78201 | High | 7.3 | 2026-08-24 | A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of… |
CVE-2026-78200 | Medium | 6.3 | 2026-08-24 | A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipul… |
CVE-2026-78199 | High | 7.3 | 2026-08-24 | A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performi… |
CVE-2026-78198 | High | 7.3 | 2026-08-24 | A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fo… |
CVE-2026-78197 | High | 7.3 | 2026-08-24 | A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.ph… |
CVE-2026-78196 | Medium | 4.4 | 2026-08-24 | A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of… |
CVE-2026-78187 | Low | 3.1 | 2026-08-24 | A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argumen… |
CVE-2026-78186 | Medium | 4.3 | 2026-08-24 | A flaw has been found in Open5GS up to 2.8.0. This affects an unknown function of the file src/hss/hss-cx-path.c of the component HSS. This manipulation of the… |
CVE-2026-59561 | High | 7.8 | 2026-08-24 | Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a… |
CVE-2026-78213 | High | 8.7 | 2026-08-24 | Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious co… |
CVE-2026-78212 | High | 7.5 | 2026-08-24 | 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path… |
CVE-2026-78211 | Critical | 9.8 | 2026-08-24 | 4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious comma… |
CVE-2026-78185 | Medium | 6.3 | 2026-08-24 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The… |
CVE-2026-78182 | High | 7.3 | 2026-08-24 | A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected elem… |
CVE-2026-78181 | High | 7.3 | 2026-08-24 | A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulatio… |
CVE-2026-78180 | High | 7.3 | 2026-08-24 | A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components… |
CVE-2026-78179 | Medium | 6.3 | 2026-08-24 | A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object… |
CVE-2026-19853 | Medium | 5.3 | 2026-08-24 | NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality t… |
CVE-2026-19852 | Medium | 6.1 | 2026-08-24 | NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including… |
CVE-2026-19200 | High | 8.9 | 2026-08-24 | The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function… |
CVE-2026-78178 | High | 7.3 | 2026-08-24 | A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. Th… |
CVE-2026-78177 | Medium | 4.5 | 2026-08-24 | A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src… |
CVE-2026-78171 | High | 7.3 | 2026-08-24 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pr… |
CVE-2026-78170 | High | 8.8 | 2026-08-24 | A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipul… |
CVE-2026-78169 | Critical | 9.9 | 2026-08-24 | A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the… |
CVE-2026-78168 | Critical | 9.8 | 2026-08-24 | A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Va… |
CVE-2026-78167 | Critical | 10.0 | 2026-08-24 | A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validatio… |
CVE-2026-78166 | Medium | 6.3 | 2026-08-24 | A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src… |
CVE-2026-78209 | High | 8.2 | 2026-08-24 | exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported c… |
CVE-2026-78208 | High | 7.5 | 2026-08-24 | exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbit… |
CVE-2026-78207 | Critical | 9.4 | 2026-08-24 | exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when… |
CVE-2026-78206 | High | 7.5 | 2026-08-24 | exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attacker… |
CVE-2026-78205 | Medium | 5.8 | 2026-08-24 | BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject… |
CVE-2026-78204 | Medium | 5.4 | 2026-08-24 | Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only req… |
CVE-2026-78203 | High | 7.1 | 2026-08-24 | Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from o… |
CVE-2026-78161 | High | 7.3 | 2026-08-24 | A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recor… |
CVE-2026-78160 | Medium | 6.3 | 2026-08-24 | A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the compon… |
CVE-2026-78158 | Medium | 6.3 | 2026-08-24 | A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipula… |
CVE-2026-78157 | High | 7.4 | 2026-08-24 | A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Hand… |
CVE-2026-78156 | High | 7.4 | 2026-08-24 | A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c… |
CVE-2026-78148 | Medium | 5.3 | 2026-08-24 | A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp… |
CVE-2026-78147 | High | 7.3 | 2026-08-23 | A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp o… |
CVE-2026-78145 | Medium | 4.3 | 2026-08-23 | A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manip… |
CVE-2026-78144 | Medium | 6.3 | 2026-08-23 | A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-78143 | High | 7.3 | 2026-08-23 | A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of… |
CVE-2026-78142 | Medium | 6.3 | 2026-08-23 | A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.ph… |
CVE-2026-78141 | High | 7.4 | 2026-08-23 | A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument… |
CVE-2026-78183 | Critical | 9.8 | 2026-08-23 | DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the… |
CVE-2026-78140 | Medium | 4.7 | 2026-08-23 | A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/Web… |
CVE-2026-19565 | Low | 3.7 | 2026-08-23 | Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey… |
CVE-2026-75922 | Medium | 5.3 | 2026-08-23 | Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI… |
CVE-2026-9769 | High | 7.5 | 2026-08-23 | justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.fini… |
CVE-2026-8630 | Medium | 6.1 | 2026-08-23 | justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <st… |
CVE-2026-8445 | Critical | 9.8 | 2026-08-23 | justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed do… |
CVE-2026-7808 | Critical | 9.8 | 2026-08-23 | justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitizatio… |
CVE-2026-77088 | Medium | 6.1 | 2026-08-23 | justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as… |
CVE-2026-74793 | Medium | 6.1 | 2026-08-23 | justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections… |
CVE-2026-6827 | Medium | 6.1 | 2026-08-23 | justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign n… |
CVE-2026-5751 | Medium | 6.1 | 2026-08-23 | justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy… |
CVE-2026-5389 | Medium | 6.1 | 2026-08-23 | justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. At… |
CVE-2026-5388 | Critical | 9.8 | 2026-08-23 | justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown pas… |
CVE-2026-4671 | High | 7.5 | 2026-08-23 | justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-… |
CVE-2026-78155 | Critical | 9.9 | 2026-08-23 | privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges |
CVE-2026-78115 | Medium | 5.4 | 2026-08-23 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.ph… |
CVE-2026-78112 | Medium | 6.3 | 2026-08-23 | A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This ma… |
CVE-2026-10053 | High | 8.5 | 2026-08-23 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-77116 | Medium | 4.3 | 2026-08-23 | Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Cus… |
CVE-2026-77115 | High | 7.1 | 2026-08-23 | Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them. |
CVE-2026-77003 | Low | 2.7 | 2026-08-23 | The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as l… |
CVE-2026-14853 | Medium | 4.3 | 2026-08-23 | The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by o… |
CVE-2026-13598 | Critical | 9.8 | 2026-08-23 | The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to cre… |
CVE-2026-78063 | High | 7.4 | 2026-08-23 | A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipula… |
CVE-2026-78062 | High | 7.3 | 2026-08-23 | A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component… |
CVE-2026-78061 | Medium | 6.3 | 2026-08-23 | A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the compon… |
CVE-2026-78060 | Medium | 4.3 | 2026-08-23 | A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php… |
CVE-2026-78059 | Medium | 4.3 | 2026-08-23 | A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /php_action/printOrder.php. S… |
CVE-2026-78057 | Medium | 6.3 | 2026-08-23 | A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown part of the component Mana… |
CVE-2026-78056 | Medium | 6.3 | 2026-08-23 | A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown func… |
CVE-2026-78055 | Medium | 4.3 | 2026-08-23 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality… |