2026 CVEs (page 208)
Page 208 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17252 | | 2026-08-21 | A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7… | |
CVE-2026-17251 | | 2026-08-21 | A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the… | |
CVE-2026-17250 | | 2026-08-21 | A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadat… | |
CVE-2026-74583 | High | 7.8 | 2026-08-21 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintain… |
CVE-2026-74582 | High | 7.8 | 2026-08-21 | In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->har… |
CVE-2026-74581 | Critical | 9.8 | 2026-08-21 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed rout… |
CVE-2026-74580 | High | 8.8 | 2026-08-21 | In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches th… |
CVE-2026-75933 | High | 7.3 | 2026-08-21 | Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of… |
CVE-2026-75932 | High | 8.6 | 2026-08-21 | Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traf… |
CVE-2026-75928 | Medium | 5.3 | 2026-08-21 | The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unau… |
CVE-2026-69502 | Critical | 10.0 | 2026-08-21 | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-54789 | High | 7.5 | 2026-08-21 | mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party… |
CVE-2026-49114 | High | 7.1 | 2026-08-21 | In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writ… |
CVE-2026-22681 | High | 8.5 | 2026-08-21 | OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network servi… |
CVE-2026-77815 | High | 7.5 | 2026-08-21 | to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A sym… |
CVE-2026-77814 | High | 7.5 | 2026-08-21 | is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a… |
CVE-2026-77812 | | 2026-08-21 | DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connec… | |
CVE-2026-77087 | Critical | 9.6 | 2026-08-21 | Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An att… |
CVE-2026-63343 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrar… |
CVE-2026-63125 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity wi… |
CVE-2026-62941 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`Allo… |
CVE-2026-62940 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configurat… |
CVE-2026-62867 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume… |
CVE-2026-62313 | Medium | 4.3 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privilege=isolated` can be… |
CVE-2026-55622 | High | 7.7 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker know… |
CVE-2026-55621 | High | 7.7 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker… |
CVE-2026-50278 | Medium | 6.5 | 2026-08-21 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a `CIccEmbedIO::Read8()` size_t und… |
CVE-2026-48769 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image serv… |
CVE-2026-48756 | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend… | |
CVE-2026-48755 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to arg… |
CVE-2026-48754 | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/back… | |
CVE-2026-48753 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows cre… |
CVE-2026-48752 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/wri… |
CVE-2026-48751 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting… |
CVE-2026-48750 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores t… |
CVE-2026-48749 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files… |
CVE-2026-47753 | | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go`… | |
CVE-2026-77806 | Critical | 9.8 | 2026-08-21 | SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injectio… |
CVE-2026-75946 | | 2026-08-21 | A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a… | |
CVE-2026-15580 | | 2026-08-21 | vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser e… | |
CVE-2026-77780 | | 2026-08-21 | Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transacti… | |
CVE-2026-77028 | | 2026-08-21 | Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66 | |
CVE-2026-76613 | | 2026-08-21 | Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to… | |
CVE-2026-76612 | | 2026-08-21 | Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied fie… | |
CVE-2026-76611 | | 2026-08-21 | Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66. | |
CVE-2026-75115 | | 2026-08-21 | Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerabl… | |
CVE-2026-59654 | High | 7.5 | 2026-08-21 | Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modul… |
CVE-2026-77776 | Critical | 9.1 | 2026-08-21 | Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handl… |
CVE-2026-77775 | High | 8.6 | 2026-08-21 | Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_base in headroom/proxy… |
CVE-2026-77759 | | 2026-08-21 | Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read th… | |
CVE-2026-77029 | | 2026-08-21 | Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66 | |
CVE-2026-59318 | Medium | 6.5 | 2026-08-21 | In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatche… |
CVE-2026-59308 | Medium | 4.2 | 2026-08-21 | In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be sh… |
CVE-2026-59279 | High | 7.5 | 2026-08-21 | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not r… |
CVE-2026-19848 | Medium | 6.5 | 2026-08-21 | The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauth… |
CVE-2026-18356 | Low | 3.7 | 2026-08-21 | The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account f… |
CVE-2026-17559 | Medium | 5.3 | 2026-08-21 | The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global passw… |
CVE-2026-16650 | Medium | 5.3 | 2026-08-21 | The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing u… |
CVE-2026-15150 | Medium | 5.3 | 2026-08-21 | The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant a… |
CVE-2026-15046 | Medium | 4.2 | 2026-08-21 | The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authent… |
CVE-2026-13176 | Low | 2.7 | 2026-08-21 | The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contr… |
CVE-2026-77769 | Medium | 6.5 | 2026-08-21 | The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The… |
CVE-2026-77768 | Medium | 6.5 | 2026-08-21 | The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly. The enforceAccess middl… |
CVE-2026-77767 | High | 7.5 | 2026-08-21 | Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so contro… |
CVE-2026-77763 | Medium | 6.5 | 2026-08-21 | The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from path(key)… |
CVE-2026-77761 | | 2026-08-21 | A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP ev… | |
CVE-2026-77686 | Medium | 5.4 | 2026-08-21 | A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This m… |
CVE-2026-77683 | Critical | 9.9 | 2026-08-21 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§i… |
CVE-2026-77086 | Critical | 9.1 | 2026-08-21 | SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform pa… |
CVE-2026-59296 | Medium | 5.9 | 2026-08-21 | Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose in… |
CVE-2026-15576 | | 2026-08-21 | Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verificati… | |
CVE-2026-14208 | | 2026-08-21 | Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting F… | |
CVE-2026-77755 | | 2026-08-21 | A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.ex… | |
CVE-2026-77751 | | 2026-08-21 | A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are pas… | |
CVE-2026-77681 | Medium | 6.3 | 2026-08-21 | A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile… |
CVE-2026-59323 | Medium | 5.3 | 2026-08-21 | An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object alloc… |
CVE-2026-48590 | | 2026-08-21 | XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program… | |
CVE-2026-47827 | High | 7.5 | 2026-08-21 | Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command injection vulnerabiliti… |
CVE-2026-47080 | | 2026-08-21 | XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program… | |
CVE-2026-47079 | | 2026-08-21 | Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulner… | |
CVE-2026-77710 | | 2026-08-21 | A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic… | |
CVE-2026-74866 | Medium | 5.8 | 2026-08-21 | @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-fee… |
CVE-2026-68745 | High | 8.1 | 2026-08-21 | Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML resp… |
CVE-2026-66797 | Medium | 5.4 | 2026-08-21 | Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation… |
CVE-2026-66722 | High | 7.2 | 2026-08-21 | Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update… |
CVE-2026-66721 | Low | 2.7 | 2026-08-21 | Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listH… |
CVE-2026-65613 | Medium | 4.3 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This iss… |
CVE-2026-63046 | High | 8.8 | 2026-08-21 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arb… |
CVE-2026-62440 | Critical | 9.1 | 2026-08-21 | Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster whil… |
CVE-2026-61422 | Medium | 4.3 | 2026-08-21 | Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudS… |
CVE-2026-61400 | High | 8.8 | 2026-08-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality… |
CVE-2026-61399 | Medium | 4.8 | 2026-08-21 | Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: fro… |
CVE-2026-61398 | Critical | 9.1 | 2026-08-21 | Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache C… |
CVE-2026-61397 | High | 7.5 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. Thi… |
CVE-2026-59799 | High | 8.8 | 2026-08-21 | Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable fl… |
CVE-2026-59780 | High | 7.5 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. … |
CVE-2026-59657 | High | 7.5 | 2026-08-21 | Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. This issue affects Apache CloudStack: fro… |
CVE-2026-59655 | High | 7.5 | 2026-08-21 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. Thi… |
CVE-2026-59085 | Critical | 9.1 | 2026-08-21 | Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache C… |
CVE-2026-50222 | High | 7.5 | 2026-08-21 | Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userda… |