2026 CVEs (page 209)
Page 209 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50112 | High | 8.8 | 2026-08-21 | SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal… |
CVE-2026-47359 | High | 8.8 | 2026-08-21 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The… |
CVE-2026-77264 | Critical | 9.8 | 2026-08-21 | The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versi… |
CVE-2026-73537 | Medium | 4.7 | 2026-08-21 | Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser compon… |
CVE-2026-19441 | Medium | 5.3 | 2026-08-21 | Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082… |
CVE-2026-16323 | High | 7.5 | 2026-08-21 | Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This is… |
CVE-2026-75796 | High | 7.2 | 2026-08-21 | The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged… |
CVE-2026-19435 | Low | 2.7 | 2026-08-21 | The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to rea… |
CVE-2026-19085 | Low | 2.7 | 2026-08-21 | The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegat… |
CVE-2026-18781 | High | 8.1 | 2026-08-21 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping… |
CVE-2026-16962 | Medium | 5.3 | 2026-08-21 | The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs… |
CVE-2026-16959 | Medium | 6.8 | 2026-08-21 | The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-libr… |
CVE-2026-16577 | Low | 2.7 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against t… |
CVE-2026-16576 | High | 7.2 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its ad… |
CVE-2026-16575 | Medium | 5.3 | 2026-08-21 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configurat… |
CVE-2026-14601 | Medium | 6.8 | 2026-08-21 | The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated us… |
CVE-2026-14325 | Low | 3.5 | 2026-08-21 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag na… |
CVE-2026-13736 | Medium | 5.3 | 2026-08-21 | The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing… |
CVE-2026-65645 | Medium | 4.3 | 2026-08-21 | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages… |
CVE-2026-65644 | High | 7.5 | 2026-08-21 | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that a… |
CVE-2026-45202 | Medium | 5.5 | 2026-08-21 | Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario… |
CVE-2026-45201 | High | 7.8 | 2026-08-21 | Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading… |
CVE-2026-45199 | High | 7.8 | 2026-08-21 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualis… |
CVE-2026-18409 | High | 7.2 | 2026-08-21 | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, a… |
CVE-2026-76158 | | 2026-08-21 | External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write… | |
CVE-2026-76137 | Low | 3.3 | 2026-08-21 | Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Ed… |
CVE-2026-76131 | Medium | 5.3 | 2026-08-21 | Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's… |
CVE-2026-73267 | High | 7.7 | 2026-08-21 | A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim r… |
CVE-2026-77392 | Medium | 6.3 | 2026-08-21 | A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /pu… |
CVE-2026-77391 | Medium | 4.3 | 2026-08-21 | A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipul… |
CVE-2026-76157 | | 2026-08-21 | Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticate… | |
CVE-2026-76156 | | 2026-08-21 | OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrar… | |
CVE-2026-76155 | | 2026-08-21 | Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the managemen… | |
CVE-2026-77651 | Critical | 9.8 | 2026-08-21 | The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that… |
CVE-2026-77650 | Critical | 9.8 | 2026-08-21 | The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependenc… |
CVE-2026-77649 | Critical | 9.8 | 2026-08-21 | The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency tha… |
CVE-2026-43679 | Low | 2.4 | 2026-08-21 | This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may… |
CVE-2026-20679 | Medium | 4.3 | 2026-08-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Processing a maliciously craf… |
CVE-2026-16520 | | 2026-08-21 | Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Gen… | |
CVE-2026-77648 | Low | 2.2 | 2026-08-20 | In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs fro… |
CVE-2026-77647 | Critical | 9.8 | 2026-08-20 | SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect ide… |
CVE-2026-77113 | | 2026-08-20 | Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with t… | |
CVE-2026-77646 | | 2026-08-20 | A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the d… | |
CVE-2026-77645 | | 2026-08-20 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deseria… | |
CVE-2026-77644 | | 2026-08-20 | A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition. | |
CVE-2026-77643 | Medium | 4.4 | 2026-08-20 | A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HT… |
CVE-2026-77642 | High | 7.5 | 2026-08-20 | tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor… |
CVE-2026-72860 | High | 8.5 | 2026-08-20 | The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination wit… |
CVE-2026-72848 | High | 8.6 | 2026-08-20 | SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries… |
CVE-2026-72846 | Medium | 6.4 | 2026-08-20 | Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleCha… |
CVE-2026-72843 | Critical | 9.8 | 2026-08-20 | The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes… |
CVE-2026-72818 | High | 7.5 | 2026-08-20 | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain br… |
CVE-2026-70105 | Medium | 6.5 | 2026-08-20 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
CVE-2026-69855 | High | 7.7 | 2026-08-20 | Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network. |
CVE-2026-69851 | Critical | 9.9 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69836 | Critical | 10.0 | 2026-08-20 | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. |
CVE-2026-69558 | High | 8.6 | 2026-08-20 | Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network. |
CVE-2026-69555 | Critical | 10.0 | 2026-08-20 | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69543 | High | 8.5 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69519 | High | 8.6 | 2026-08-20 | Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network. |
CVE-2026-69419 | High | 8.5 | 2026-08-20 | Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network. |
CVE-2026-69400 | Critical | 9.6 | 2026-08-20 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-68789 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-68782 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-67448 | Medium | 6.5 | 2026-08-20 | Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for t… |
CVE-2026-67447 | Medium | 5.3 | 2026-08-20 | Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.Rea… |
CVE-2026-66800 | High | 8.6 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network. |
CVE-2026-66309 | Critical | 9.1 | 2026-08-20 | Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network. |
CVE-2026-65816 | Critical | 10.0 | 2026-08-20 | Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-65801 | Critical | 10.0 | 2026-08-20 | Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-65770 | Critical | 10.0 | 2026-08-20 | Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attack… |
CVE-2026-64773 | High | 7.5 | 2026-08-20 | An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's d… |
CVE-2026-63509 | Critical | 9.9 | 2026-08-20 | Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. |
CVE-2026-62945 | Medium | 4.3 | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and ass… |
CVE-2026-62834 | Critical | 9.3 | 2026-08-20 | Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-55894 | | 2026-08-20 | Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a ra… | |
CVE-2026-55893 | | 2026-08-20 | Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and op… | |
CVE-2026-55769 | | 2026-08-20 | CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser… | |
CVE-2026-55765 | High | 8.5 | 2026-08-20 | CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartex… |
CVE-2026-55491 | Medium | 5.4 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/inde… |
CVE-2026-55489 | Medium | 4.9 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified… |
CVE-2026-55015 | Medium | 5.5 | 2026-08-20 | Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally. |
CVE-2026-55013 | High | 7.1 | 2026-08-20 | Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally. |
CVE-2026-54509 | Medium | 6.5 | 2026-08-20 | TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result o… |
CVE-2026-54508 | | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNa… | |
CVE-2026-54505 | | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into j… | |
CVE-2026-54389 | Medium | 5.5 | 2026-08-20 | Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by sup… |
CVE-2026-50192 | | 2026-08-20 | Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials… | |
CVE-2026-49436 | High | 7.3 | 2026-08-20 | LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without… |
CVE-2026-49245 | Low | 3.7 | 2026-08-20 | SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authent… |
CVE-2026-49244 | Medium | 5.9 | 2026-08-20 | SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable shar… |
CVE-2026-49217 | High | 7.5 | 2026-08-20 | Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthentic… |
CVE-2026-46682 | High | 8.5 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and user… |
CVE-2026-46355 | High | 7.1 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/g… |
CVE-2026-19783 | Medium | 6.7 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel memory corruption due to insufficient validation. A crafted filesyst… |
CVE-2026-19449 | High | 8.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root. |
CVE-2026-19448 | Medium | 6.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitatio… |
CVE-2026-19446 | High | 7.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in c… |
CVE-2026-19442 | High | 8.2 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation ma… |
CVE-2026-19437 | High | 8.1 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |