2026 CVEs (page 207)
Page 207 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56332 | Medium | 4.7 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external webs… |
CVE-2026-56330 | Low | 3.5 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, a… |
CVE-2026-56325 | Low | 3.1 | 2026-06-20 | Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters… |
CVE-2026-56319 | Medium | 4.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distingu… |
CVE-2026-56317 | Medium | 6.1 | 2026-06-20 | Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerH… |
CVE-2026-56307 | Medium | 4.3 | 2026-06-20 | Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authentic… |
CVE-2026-56304 | Medium | 6.5 | 2026-06-20 | picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logg… |
CVE-2026-56295 | Medium | 6.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_ap… |
CVE-2026-56294 | Medium | 4.8 | 2026-06-20 | capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate Crypt… |
CVE-2026-56282 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replicatio… |
CVE-2026-56276 | | 2026-06-20 | Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credentia… | |
CVE-2026-56267 | | 2026-06-20 | Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects includ… | |
CVE-2026-56235 | Medium | 5.3 | 2026-06-20 | Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metri… |
CVE-2026-56228 | Medium | 4.9 | 2026-06-20 | Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization… |
CVE-2026-56227 | Medium | 5.4 | 2026-06-20 | Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization… |
CVE-2026-56218 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download… |
CVE-2026-12673 | | 2026-06-20 | Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain… | |
CVE-2026-48939 | Critical | 9.8 | 2026-06-20 | A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code uplo… |
CVE-2026-48909 | | 2026-06-20 | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute ar… | |
CVE-2026-48908 | Critical | 9.8 | 2026-06-20 | A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP c… |
CVE-2026-12119 | Medium | 6.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode att… |
CVE-2026-11912 | High | 7.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and incl… |
CVE-2026-11911 | High | 7.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in… |
CVE-2026-9843 | High | 8.1 | 2026-06-20 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validatio… |
CVE-2026-9265 | Critical | 9.1 | 2026-06-20 | Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 a… |
CVE-2026-56216 | High | 8.8 | 2026-06-20 | Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted… |
CVE-2026-56215 | High | 8.3 | 2026-06-20 | Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts… |
CVE-2026-56214 | High | 7.5 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthent… |
CVE-2026-56213 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, all… |
CVE-2026-56212 | Low | 3.8 | 2026-06-20 | Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-f… |
CVE-2026-11551 | Critical | 9.8 | 2026-06-20 | The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plu… |
CVE-2026-56082 | High | 7.5 | 2026-06-19 | Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time… |
CVE-2026-56081 | Critical | 9.1 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before tha… |
CVE-2026-56080 | Medium | 4.9 | 2026-06-19 | Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to… |
CVE-2026-56079 | Medium | 6.5 | 2026-06-19 | Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other te… |
CVE-2026-56073 | Critical | 9.4 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying serv… |
CVE-2026-50559 | High | 7.5 | 2026-06-19 | Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus… |
CVE-2026-50519 | Medium | 6.5 | 2026-06-19 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a n… |
CVE-2026-49346 | High | 7.1 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit… |
CVE-2026-49337 | Medium | 4.3 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265 NAL units causes `decoder_context::rea… |
CVE-2026-49295 | High | 7.1 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write i… |
CVE-2026-48794 | | 2026-06-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… | |
CVE-2026-48584 | Critical | 9.9 | 2026-06-19 | Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network. |
CVE-2026-48582 | Critical | 9.6 | 2026-06-19 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. |
CVE-2026-48129 | Medium | 6.5 | 2026-06-19 | Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered f… |
CVE-2026-47645 | High | 8.8 | 2026-06-19 | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a netwo… |
CVE-2026-47203 | | 2026-06-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… | |
CVE-2026-45480 | Critical | 10.0 | 2026-06-19 | Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-42895 | Medium | 6.5 | 2026-06-19 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-32208 | High | 8.8 | 2026-06-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing ov… |
CVE-2026-49345 | | 2026-06-19 | Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vu… | |
CVE-2026-49344 | | 2026-06-19 | Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/querie… | |
CVE-2026-49342 | Medium | 5.3 | 2026-06-19 | YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the… |
CVE-2026-48787 | | 2026-06-19 | gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an authenticated attacker with access to the code-generation feature and MCP mana… | |
CVE-2026-48774 | High | 7.5 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP `run_sql_readonly` tool violates its… |
CVE-2026-48773 | Critical | 9.8 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerabilit… |
CVE-2026-48772 | Critical | 10.0 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the `PROXY UNKNOWN <ad… |
CVE-2026-48715 | High | 8.8 | 2026-06-19 | radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route… |
CVE-2026-48089 | | 2026-06-19 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any a… | |
CVE-2026-49340 | High | 8.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` a… |
CVE-2026-49339 | High | 7.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410… |
CVE-2026-49338 | High | 7.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist… |
CVE-2026-49336 | | 2026-06-19 | @microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@mic… | |
CVE-2026-49293 | High | 7.5 | 2026-06-19 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary intege… |
CVE-2026-49291 | High | 8.1 | 2026-06-19 | mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read… |
CVE-2026-49288 | Medium | 4.3 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and… |
CVE-2026-27878 | Medium | 6.5 | 2026-06-19 | A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-… |
CVE-2026-12726 | Medium | 6.3 | 2026-06-19 | A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value… |
CVE-2026-12238 | Medium | 5.3 | 2026-06-19 | The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due… |
CVE-2026-49359 | Medium | 6.5 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of… |
CVE-2026-49290 | | 2026-06-19 | Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal… | |
CVE-2026-49287 | High | 7.4 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the… |
CVE-2026-49286 | High | 8.1 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output file… |
CVE-2026-49271 | Medium | 6.5 | 2026-06-19 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offs… |
CVE-2026-56211 | High | 7.1 | 2026-06-19 | A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Sca… |
CVE-2026-56210 | High | 7.1 | 2026-06-19 | A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding… |
CVE-2026-56209 | High | 7.1 | 2026-06-19 | An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding)… |
CVE-2026-56208 | High | 7.6 | 2026-06-19 | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode… |
CVE-2026-51846 | Critical | 9.8 | 2026-06-19 | In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can lead to remote arbitr… |
CVE-2026-51845 | Critical | 9.8 | 2026-06-19 | Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter. |
CVE-2026-51844 | Critical | 9.8 | 2026-06-19 | Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter. |
CVE-2026-51843 | Critical | 9.8 | 2026-06-19 | Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter. |
CVE-2026-49260 | High | 8.2 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell comman… |
CVE-2026-3196 | Medium | 5.5 | 2026-06-19 | An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream c… |
CVE-2026-3195 | High | 7.4 | 2026-06-19 | A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov c… |
CVE-2026-12622 | Medium | 5.4 | 2026-06-19 | The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03… |
CVE-2026-12621 | Medium | 5.4 | 2026-06-19 | Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridT… |
CVE-2026-12620 | Medium | 6.5 | 2026-06-19 | The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1… |
CVE-2026-12619 | Medium | 5.4 | 2026-06-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scriptin… |
CVE-2026-52910 | High | 7.8 | 2026-06-19 | In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below… |
CVE-2026-52909 | High | 7.8 | 2026-06-19 | In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported t… |
CVE-2026-52908 | High | 7.8 | 2026-06-19 | In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_REREG_ACCESS change… |
CVE-2026-49358 | Low | 3.0 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public arr… |
CVE-2026-21768 | Medium | 6.3 | 2026-06-19 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby all… |
CVE-2026-9143 | Low | 3.7 | 2026-06-19 | There is an incorrect conversion between numeric types vulnerability in NI grpc-device due to missing range checks in CodeGen. This may silently discard high… |
CVE-2026-9142 | Critical | 9.1 | 2026-06-19 | There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This m… |
CVE-2026-4027 | | 2026-06-19 | A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficie… | |
CVE-2026-4026 | | 2026-06-19 | A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings… | |
CVE-2026-49872 | High | 8.1 | 2026-06-19 | Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credent… |
CVE-2026-49871 | Critical | 9.3 | 2026-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send… |