2026 CVEs (page 204)
Page 204 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56379 | High | 8.1 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing c… |
CVE-2026-56376 | Low | 3.7 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale p… |
CVE-2026-56371 | Medium | 5.3 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocate… |
CVE-2026-56322 | High | 7.5 | 2026-06-23 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter befo… |
CVE-2026-56315 | Critical | 9.8 | 2026-06-23 | picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib)… |
CVE-2026-56301 | Medium | 5.5 | 2026-06-23 | Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namesp… |
CVE-2026-56275 | High | 7.1 | 2026-06-23 | Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by provi… |
CVE-2026-56274 | Critical | 9.9 | 2026-06-23 | Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete command-flag validation and a re… |
CVE-2026-56263 | Medium | 6.1 | 2026-06-23 | Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML wi… |
CVE-2026-56258 | High | 8.1 | 2026-06-23 | Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files o… |
CVE-2026-56248 | High | 7.5 | 2026-06-23 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Securit… |
CVE-2026-56243 | High | 8.1 | 2026-06-23 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header desp… |
CVE-2026-56234 | Medium | 5.3 | 2026-06-23 | Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable u… |
CVE-2026-56225 | High | 8.3 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with mod… |
CVE-2026-56222 | High | 7.2 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped rol… |
CVE-2026-54892 | | 2026-06-23 | Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.dec… | |
CVE-2026-4610 | Medium | 6.4 | 2026-06-23 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter… |
CVE-2026-44089 | | 2026-06-23 | Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability could be exploited to c… | |
CVE-2026-10857 | Medium | 6.1 | 2026-06-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in AKIN Software Computer Import Export Industry and Trade L… |
CVE-2026-10711 | High | 8.8 | 2026-06-23 | Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functional… |
CVE-2026-4983 | Medium | 4.1 | 2026-06-23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security h… |
CVE-2026-11374 | Critical | 9.0 | 2026-06-23 | In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be… |
CVE-2026-9733 | Critical | 9.1 | 2026-06-23 | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the co… |
CVE-2026-10521 | High | 7.2 | 2026-06-23 | An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters… |
CVE-2026-8379 | High | 7.5 | 2026-06-23 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated… |
CVE-2026-8378 | Medium | 5.4 | 2026-06-23 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before st… |
CVE-2026-8172 | High | 7.1 | 2026-06-23 | The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on valida… |
CVE-2026-8163 | High | 8.8 | 2026-06-23 | The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL… |
CVE-2026-7842 | Medium | 6.8 | 2026-06-23 | The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_… |
CVE-2026-12866 | Critical | 9.8 | 2026-06-23 | All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying cr… |
CVE-2026-55655 | Medium | 5.0 | 2026-06-23 | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-bi… |
CVE-2026-55654 | Low | 3.7 | 2026-06-23 | A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programmi… |
CVE-2026-55653 | Medium | 4.3 | 2026-06-23 | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occ… |
CVE-2026-11833 | | 2026-06-23 | Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This… | |
CVE-2026-10658 | High | 7.1 | 2026-06-23 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from… |
CVE-2026-10651 | High | 7.1 | 2026-06-23 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute I… |
CVE-2026-10645 | Medium | 4.9 | 2026-06-23 | The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. ext2_f… |
CVE-2026-54236 | Medium | 5.3 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message h… |
CVE-2026-54235 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >)… |
CVE-2026-54233 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload… |
CVE-2026-54232 | High | 8.8 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack t… |
CVE-2026-53923 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF de… |
CVE-2026-48746 | Critical | 9.1 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on… |
CVE-2026-47155 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all ar… |
CVE-2026-41523 | High | 7.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading… |
CVE-2026-56698 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script executio… |
CVE-2026-56697 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-p… |
CVE-2026-56357 | Medium | 4.0 | 2026-06-22 | n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verific… |
CVE-2026-56348 | Critical | 9.1 | 2026-06-22 | n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users t… |
CVE-2026-56326 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-nor… |
CVE-2026-56324 | High | 8.2 | 2026-06-22 | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the… |
CVE-2026-56323 | High | 7.5 | 2026-06-22 | Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enum… |
CVE-2026-56321 | Medium | 5.3 | 2026-06-22 | Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint… |
CVE-2026-56314 | High | 7.1 | 2026-06-22 | Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to remain selectable. At… |
CVE-2026-56311 | Medium | 5.3 | 2026-06-22 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthenticated attackers… |
CVE-2026-56306 | Medium | 6.4 | 2026-06-22 | Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting mal… |
CVE-2026-56280 | High | 7.1 | 2026-06-22 | Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native bu… |
CVE-2026-56268 | High | 7.7 | 2026-06-22 | Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omi… |
CVE-2026-56266 | High | 8.6 | 2026-06-22 | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supp… |
CVE-2026-56255 | Medium | 4.3 | 2026-06-22 | Capgo before 12.128.2 contains a denial of service vulnerability in the POST /app/demo endpoint that allows authenticated users with org write permissions to c… |
CVE-2026-56221 | Medium | 6.5 | 2026-06-22 | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated d… |
CVE-2026-55409 | High | 7.6 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw st… |
CVE-2026-54911 | Medium | 6.5 | 2026-06-22 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()… |
CVE-2026-54281 | | 2026-06-22 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform… | |
CVE-2026-48517 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializer… |
CVE-2026-48516 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, InterfaceLookupFormatter<TKey,TElement> constructs an internal Dictionary<TK… |
CVE-2026-48515 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengt… |
CVE-2026-48514 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled byteLeng… |
CVE-2026-48513 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, runtime-generated union deserializers emitted by DynamicUnionResolver do not… |
CVE-2026-48512 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's JSON conversion helpers contain multiple recursion path… |
CVE-2026-48511 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by… |
CVE-2026-48510 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it… |
CVE-2026-48509 | Critical | 9.1 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default seria… |
CVE-2026-48506 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.TrySkip() recursively descends into nested arrays and maps… |
CVE-2026-48505 | High | 7.4 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery co… |
CVE-2026-48502 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attac… |
CVE-2026-48500 | Medium | 6.5 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a fil… |
CVE-2026-48167 | Medium | 6.4 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry compon… |
CVE-2026-48166 | Medium | 5.3 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timi… |
CVE-2026-48109 | High | 8.2 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by Messag… |
CVE-2026-48067 | Medium | 6.5 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tab… |
CVE-2026-44889 | Medium | 6.1 | 2026-06-22 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an op… |
CVE-2026-44311 | Medium | 5.4 | 2026-06-22 | Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escapi… |
CVE-2026-55603 | High | 7.5 | 2026-06-22 | http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a… |
CVE-2026-55599 | Medium | 5.8 | 2026-06-22 | phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate wit… |
CVE-2026-54651 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite lo… |
CVE-2026-54531 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite lo… |
CVE-2026-54530 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite lo… |
CVE-2026-49468 | Critical | 9.8 | 2026-06-22 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, u… |
CVE-2026-49461 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory u… |
CVE-2026-49460 | Low | 3.3 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes… |
CVE-2026-47242 | | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash a… | |
CVE-2026-47241 | | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw s… | |
CVE-2026-47240 | | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw… | |
CVE-2026-45034 | | 2026-06-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrapper… | |
CVE-2026-44727 | Medium | 5.4 | 2026-06-22 | Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML und… |
CVE-2026-41479 | Medium | 5.4 | 2026-06-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned… |
CVE-2026-39904 | Medium | 6.5 | 2026-06-22 | Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a cr… |
CVE-2026-48931 | Low | 3.7 | 2026-06-22 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affect… |
CVE-2026-44274 | High | 7.8 | 2026-06-22 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker w… |