2026 CVEs (page 211)
Page 211 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77148 | Critical | 9.9 | 2026-08-20 | A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of… |
CVE-2026-75526 | Medium | 4.4 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_plac… |
CVE-2026-75514 | Medium | 5.9 | 2026-08-20 | BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blackli… |
CVE-2026-72854 | Medium | 5.3 | 2026-08-20 | msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked… |
CVE-2026-72852 | High | 7.8 | 2026-08-20 | hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int… |
CVE-2026-66788 | Low | 3.7 | 2026-08-20 | A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource in… |
CVE-2026-66787 | Medium | 5.4 | 2026-08-20 | A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of ad… |
CVE-2026-66785 | Low | 2.5 | 2026-08-20 | A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters)… |
CVE-2026-66002 | | 2026-08-20 | Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frap… | |
CVE-2026-66001 | | 2026-08-20 | Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the… | |
CVE-2026-64777 | Medium | 4.3 | 2026-08-20 | A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when i… |
CVE-2026-63654 | | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frap… | |
CVE-2026-63003 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-le… |
CVE-2026-62315 | | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied thro… | |
CVE-2026-61663 | Medium | 4.3 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to au… |
CVE-2026-54624 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/view… |
CVE-2026-54622 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/ad… |
CVE-2026-53587 | High | 7.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53586 | Medium | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53585 | Medium | 5.3 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53584 | Medium | 4.3 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53583 | Medium | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-53569 | | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py… | |
CVE-2026-50190 | | 2026-08-20 | Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListControlle… | |
CVE-2026-49996 | Low | 3.7 | 2026-08-20 | SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version… |
CVE-2026-43678 | Medium | 5.3 | 2026-08-20 | An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed Web… |
CVE-2026-19683 | High | 7.4 | 2026-08-20 | A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication… |
CVE-2026-19586 | Critical | 9.8 | 2026-08-20 | A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient va… |
CVE-2026-15743 | Medium | 5.7 | 2026-08-20 | Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control h… |
CVE-2026-77036 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigContr… |
CVE-2026-77031 | High | 7.4 | 2026-08-20 | A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manip… |
CVE-2026-76641 | High | 7.5 | 2026-08-20 | Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity pars… |
CVE-2026-73259 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using… |
CVE-2026-73258 | Medium | 6.5 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input proce… |
CVE-2026-73257 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Conte… |
CVE-2026-73256 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by se… |
CVE-2026-73255 | Medium | 6.5 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences… |
CVE-2026-73254 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cr… |
CVE-2026-73253 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can… |
CVE-2026-73251 | Critical | 9.1 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a m… |
CVE-2026-72847 | Medium | 4.6 | 2026-08-20 | broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy()… |
CVE-2026-72844 | Medium | 6.3 | 2026-08-20 | The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_induc… |
CVE-2026-63495 | High | 7.5 | 2026-08-20 | Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-… |
CVE-2026-63388 | High | 8.4 | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_sock… |
CVE-2026-63387 | High | 7.0 | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels… |
CVE-2026-63385 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal deco… | |
CVE-2026-63384 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarsha… | |
CVE-2026-63383 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decod… | |
CVE-2026-63382 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Enco… | |
CVE-2026-63381 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference proces… | |
CVE-2026-63380 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error… | |
CVE-2026-63379 | | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and… | |
CVE-2026-54625 | Medium | 4.8 | 2026-08-20 | django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request head… |
CVE-2026-54623 | High | 7.1 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/adm… |
CVE-2026-53425 | | 2026-08-20 | Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response th… | |
CVE-2026-53424 | | 2026-08-20 | Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubm… | |
CVE-2026-2334 | | 2026-08-20 | An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via… | |
CVE-2026-77176 | High | 8.1 | 2026-08-20 | A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit… |
CVE-2026-77025 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manip… |
CVE-2026-77022 | Critical | 9.9 | 2026-08-20 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&s… |
CVE-2026-77020 | High | 7.3 | 2026-08-20 | A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file pas… |
CVE-2026-77019 | High | 7.3 | 2026-08-20 | A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.ph… |
CVE-2026-71492 | | 2026-08-20 | Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/director… | |
CVE-2026-71428 | Critical | 9.3 | 2026-08-20 | The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many mo… |
CVE-2026-69183 | High | 7.5 | 2026-08-20 | Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.t… |
CVE-2026-65842 | High | 8.2 | 2026-08-20 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML throug… |
CVE-2026-64846 | Low | 2.8 | 2026-08-20 | Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exp… |
CVE-2026-63481 | | 2026-08-20 | Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl… | |
CVE-2026-61704 | High | 7.5 | 2026-08-20 | Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the ori… |
CVE-2026-61625 | Medium | 6.8 | 2026-08-20 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate back… |
CVE-2026-55642 | Critical | 9.8 | 2026-08-20 | dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to… |
CVE-2026-55586 | Medium | 6.6 | 2026-08-20 | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in… |
CVE-2026-55095 | | 2026-08-20 | OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inp… | |
CVE-2026-54770 | Medium | 6.1 | 2026-08-20 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value fo… |
CVE-2026-54616 | High | 7.1 | 2026-08-20 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742… |
CVE-2026-54449 | High | 8.8 | 2026-08-20 | LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuratio… |
CVE-2026-54136 | | 2026-08-20 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could… | |
CVE-2026-40345 | | 2026-08-20 | deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeIn… | |
CVE-2026-18309 | High | 7.8 | 2026-08-20 | GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i… |
CVE-2026-18308 | High | 7.8 | 2026-08-20 | GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-18307 | High | 7.8 | 2026-08-20 | GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-18306 | High | 7.8 | 2026-08-20 | GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-18305 | High | 7.8 | 2026-08-20 | GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-18304 | High | 7.8 | 2026-08-20 | GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-18303 | High | 7.8 | 2026-08-20 | GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-18302 | High | 7.8 | 2026-08-20 | GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-18301 | High | 7.8 | 2026-08-20 | GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-18300 | High | 7.8 | 2026-08-20 | GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2026-18299 | High | 7.8 | 2026-08-20 | GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2026-18298 | High | 7.8 | 2026-08-20 | GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-18297 | High | 7.8 | 2026-08-20 | GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2026-18296 | High | 7.8 | 2026-08-20 | GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-18295 | High | 7.8 | 2026-08-20 | GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2026-18294 | High | 7.8 | 2026-08-20 | OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-18293 | High | 7.8 | 2026-08-20 | OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2026-18292 | High | 7.8 | 2026-08-20 | OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2026-18291 | High | 7.8 | 2026-08-20 | OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2026-18290 | High | 7.8 | 2026-08-20 | OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2026-18289 | High | 7.8 | 2026-08-20 | OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2026-18288 | High | 7.8 | 2026-08-20 | OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |