2026 CVEs (page 206)
Page 206 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77027 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an store… | |
CVE-2026-76609 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access check… | |
CVE-2026-76608 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any a… | |
CVE-2026-76607 | | 2026-08-22 | Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2. | |
CVE-2026-76606 | | 2026-08-22 | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | |
CVE-2026-76605 | | 2026-08-22 | Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. | |
CVE-2026-76604 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the exec… | |
CVE-2026-76603 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any acc… | |
CVE-2026-76602 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without v… | |
CVE-2026-76601 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks. | |
CVE-2026-76600 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks. | |
CVE-2026-76599 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements mo… | |
CVE-2026-76598 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the ele… | |
CVE-2026-76597 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller… | |
CVE-2026-76596 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates… | |
CVE-2026-76571 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list… | |
CVE-2026-74584 | High | 7.1 | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allo… |
CVE-2026-70626 | Medium | 6.2 | 2026-08-22 | NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus… |
CVE-2026-68768 | Medium | 6.1 | 2026-08-22 | hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size… |
CVE-2026-68767 | Medium | 6.1 | 2026-08-22 | hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. At… |
CVE-2026-68766 | High | 7.8 | 2026-08-22 | hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile… |
CVE-2026-66393 | High | 7.5 | 2026-08-22 | NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by s… |
CVE-2026-65915 | Medium | 6.5 | 2026-08-22 | NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, m… |
CVE-2026-63312 | High | 7.5 | 2026-08-22 | NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() direc… |
CVE-2026-63311 | Medium | 5.3 | 2026-08-22 | NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/path… |
CVE-2026-62388 | High | 7.5 | 2026-08-22 | NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. A… |
CVE-2026-62385 | Medium | 5.9 | 2026-08-22 | NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outsid… |
CVE-2026-62384 | High | 7.5 | 2026-08-22 | NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus… |
CVE-2026-62383 | Medium | 5.5 | 2026-08-22 | nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirel… |
CVE-2026-75870 | Critical | 9.1 | 2026-08-22 | Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword… |
CVE-2026-75866 | Critical | 9.1 | 2026-08-22 | Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path read… |
CVE-2026-71514 | Low | 2.5 | 2026-08-22 | NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the colu… |
CVE-2026-71513 | High | 8.8 | 2026-08-22 | NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, a… |
CVE-2026-5093 | Medium | 4.3 | 2026-08-22 | The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12… |
CVE-2026-4561 | Medium | 6.4 | 2026-08-22 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields (e.g., 'tex… |
CVE-2026-4559 | Medium | 6.4 | 2026-08-22 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions… |
CVE-2026-2996 | High | 7.5 | 2026-08-22 | The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and includi… |
CVE-2026-62382 | | 2026-08-22 | PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push… | |
CVE-2026-62381 | Medium | 6.6 | 2026-08-22 | luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 20… |
CVE-2026-62380 | High | 7.5 | 2026-08-22 | Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection… |
CVE-2026-62243 | High | 7.5 | 2026-08-22 | Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslPr… |
CVE-2026-62204 | Medium | 6.6 | 2026-08-22 | SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin… |
CVE-2026-60084 | High | 8.7 | 2026-08-22 | SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path para… |
CVE-2026-60083 | Medium | 4.9 | 2026-08-22 | SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by… |
CVE-2026-59809 | Medium | 4.9 | 2026-08-22 | SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored… |
CVE-2026-59808 | High | 8.8 | 2026-08-22 | AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any vi… |
CVE-2026-59256 | High | 7.5 | 2026-08-22 | WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose… |
CVE-2026-58003 | High | 7.1 | 2026-08-22 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks… |
CVE-2026-58002 | Medium | 6.5 | 2026-08-22 | WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in the Users_affiliations add.json.php endpo… |
CVE-2026-58001 | Medium | 5.7 | 2026-08-22 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks an… |
CVE-2026-57998 | High | 7.8 | 2026-08-22 | better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a comman… |
CVE-2026-57944 | Medium | 5.4 | 2026-08-22 | AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Galle… |
CVE-2026-56380 | Medium | 5.3 | 2026-08-22 | AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner… |
CVE-2026-4244 | Medium | 4.3 | 2026-08-22 | The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` functio… |
CVE-2026-77988 | Medium | 6.6 | 2026-08-22 | A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvram_get of the component CLI Configuration Tool. Thi… |
CVE-2026-66917 | | 2026-08-22 | Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS e… | |
CVE-2026-66916 | | 2026-08-22 | Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass… | |
CVE-2026-4245 | Medium | 4.3 | 2026-08-22 | The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post… |
CVE-2026-3424 | Medium | 5.3 | 2026-08-22 | The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2026-77946 | Critical | 10.0 | 2026-08-22 | A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cg… |
CVE-2026-77945 | High | 7.4 | 2026-08-22 | A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a… |
CVE-2026-78003 | Critical | 9.8 | 2026-08-22 | The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. Th… |
CVE-2026-12710 | | 2026-08-22 | A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an externa… | |
CVE-2026-77002 | Critical | 9.8 | 2026-08-22 | The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing u… |
CVE-2026-77001 | Critical | 9.8 | 2026-08-22 | The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks… |
CVE-2026-77000 | Critical | 9.8 | 2026-08-22 | The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authentic… |
CVE-2026-76793 | High | 8.1 | 2026-08-22 | The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a… |
CVE-2026-76789 | High | 8.8 | 2026-08-22 | The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and… |
CVE-2026-19222 | Medium | 6.6 | 2026-08-22 | The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who… |
CVE-2026-19221 | High | 7.2 | 2026-08-22 | The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any sin… |
CVE-2026-19093 | Medium | 6.8 | 2026-08-22 | The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to r… |
CVE-2026-18052 | High | 8.1 | 2026-08-22 | The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an alread… |
CVE-2026-16738 | Medium | 5.3 | 2026-08-22 | The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the conf… |
CVE-2026-16612 | Medium | 5.3 | 2026-08-22 | The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unau… |
CVE-2026-16260 | Medium | 6.8 | 2026-08-22 | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it… |
CVE-2026-14187 | Low | 2.7 | 2026-08-22 | The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor rol… |
CVE-2026-76074 | Medium | 4.3 | 2026-08-22 | The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization byp… |
CVE-2026-76057 | Medium | 4.3 | 2026-08-22 | The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization byp… |
CVE-2026-75027 | Medium | 5.3 | 2026-08-22 | The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not prope… |
CVE-2026-19883 | High | 8.8 | 2026-08-22 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing c… |
CVE-2026-77781 | High | 7.5 | 2026-08-22 | Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception wh… |
CVE-2026-53541 | Medium | 4.3 | 2026-08-21 | OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any… |
CVE-2026-53525 | High | 7.4 | 2026-08-21 | WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time str… |
CVE-2026-53524 | Medium | 6.5 | 2026-08-21 | WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate dec… |
CVE-2026-53499 | | 2026-08-21 | FORT Validator is a Resource Public Key Infrastructure (RPKI) relying-party validator that produces validated route-origin data. FORT Validator versions throug… | |
CVE-2026-49360 | | 2026-08-21 | Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an u… | |
CVE-2026-48106 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/rep… | |
CVE-2026-48105 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegister… | |
CVE-2026-48050 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.U… | |
CVE-2026-47735 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`)… | |
CVE-2026-34949 | Medium | 6.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file creat… |
CVE-2026-34948 | High | 7.7 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQ… |
CVE-2026-53531 | | 2026-08-21 | RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stac… | |
CVE-2026-53530 | | 2026-08-21 | RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on… | |
CVE-2026-53529 | | 2026-08-21 | LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with edit… | |
CVE-2026-53528 | High | 8.8 | 2026-08-21 | LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated us… |
CVE-2026-53527 | High | 8.8 | 2026-08-21 | LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could upd… |
CVE-2026-53509 | Medium | 5.7 | 2026-08-21 | CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_qu… |
CVE-2026-53497 | Medium | 5.3 | 2026-08-21 | CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessi… |
CVE-2026-53487 | Medium | 4.3 | 2026-08-21 | Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles d… |