2026 CVEs (page 212)
Page 212 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18289 | High | 7.8 | 2026-08-20 | OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2026-18288 | High | 7.8 | 2026-08-20 | OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-18287 | High | 7.8 | 2026-08-20 | Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-18286 | High | 7.8 | 2026-08-20 | Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2026-18285 | High | 7.8 | 2026-08-20 | Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2026-18284 | High | 7.8 | 2026-08-20 | Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2026-18283 | Low | 2.4 | 2026-08-20 | Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected i… |
CVE-2026-18282 | High | 8.0 | 2026-08-20 | Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers t… |
CVE-2026-18281 | High | 8.0 | 2026-08-20 | Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execu… |
CVE-2026-18280 | Low | 3.9 | 2026-08-20 | Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code o… |
CVE-2026-18279 | High | 8.8 | 2026-08-20 | Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code… |
CVE-2026-18278 | Low | 3.5 | 2026-08-20 | Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose… |
CVE-2026-18274 | High | 7.2 | 2026-08-20 | Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-18273 | Medium | 6.6 | 2026-08-20 | Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalat… |
CVE-2026-18272 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affec… |
CVE-2026-18271 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitr… |
CVE-2026-18270 | High | 7.8 | 2026-08-20 | Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil… |
CVE-2026-18269 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arb… |
CVE-2026-18268 | High | 7.0 | 2026-08-20 | Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2026-18267 | Medium | 6.8 | 2026-08-20 | Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code… |
CVE-2026-18265 | Critical | 9.8 | 2026-08-20 | OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-18264 | High | 8.8 | 2026-08-20 | NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected insta… |
CVE-2026-18263 | High | 7.8 | 2026-08-20 | Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2026-18262 | High | 7.8 | 2026-08-20 | Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2026-15686 | High | 7.2 | 2026-08-20 | Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2026-15679 | High | 7.8 | 2026-08-20 | Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2026-13121 | High | 7.8 | 2026-08-20 | Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to esca… |
CVE-2026-77004 | High | 7.4 | 2026-08-20 | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a m… |
CVE-2026-76999 | Medium | 6.3 | 2026-08-20 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /… |
CVE-2026-76998 | High | 7.3 | 2026-08-20 | A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /a… |
CVE-2026-76997 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.ph… |
CVE-2026-75140 | High | 7.5 | 2026-08-20 | jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to ex… |
CVE-2026-63044 | Medium | 5.4 | 2026-08-20 | Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make… |
CVE-2026-63043 | High | 7.5 | 2026-08-20 | Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 befor… |
CVE-2026-63042 | High | 8.1 | 2026-08-20 | Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete… |
CVE-2026-63040 | High | 8.1 | 2026-08-20 | Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can lo… |
CVE-2026-63039 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the stri… |
CVE-2026-63038 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrar… |
CVE-2026-63037 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the… |
CVE-2026-63016 | Medium | 5.3 | 2026-08-20 | Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This… |
CVE-2026-63015 | Medium | 4.3 | 2026-08-20 | Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache In… |
CVE-2026-19611 | High | 7.4 | 2026-08-20 | A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equi… |
CVE-2026-76996 | High | 7.3 | 2026-08-20 | A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order… |
CVE-2026-76995 | Medium | 4.7 | 2026-08-20 | A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php… |
CVE-2026-76993 | Medium | 5.0 | 2026-08-20 | A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manip… |
CVE-2026-76991 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a m… |
CVE-2026-73220 | | 2026-08-20 | CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in c… | |
CVE-2026-63490 | High | 7.5 | 2026-08-20 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader reso… |
CVE-2026-61898 | High | 7.8 | 2026-08-20 | The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled L… |
CVE-2026-61897 | High | 7.8 | 2026-08-20 | An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the ef… |
CVE-2026-55558 | Medium | 5.9 | 2026-08-20 | aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220… |
CVE-2026-49825 | High | 8.2 | 2026-08-20 | lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:hre… |
CVE-2026-44725 | Medium | 6.6 | 2026-08-20 | EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the pl… |
CVE-2026-16932 | High | 8.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment v… |
CVE-2026-16928 | High | 7.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. |
CVE-2026-16927 | High | 7.3 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race conditio… |
CVE-2026-16926 | Critical | 9.1 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in… |
CVE-2026-16925 | High | 7.1 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization. |
CVE-2026-16924 | High | 7.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset duri… |
CVE-2026-16923 | High | 7.0 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. |
CVE-2026-16922 | High | 7.0 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use (TOCTOU) race condit… |
CVE-2026-76990 | High | 7.3 | 2026-08-20 | A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such… |
CVE-2026-76833 | High | 7.8 | 2026-08-20 | @cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAM… |
CVE-2026-76635 | High | 7.2 | 2026-08-20 | baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled ta… |
CVE-2026-76634 | Medium | 6.5 | 2026-08-20 | WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitr… |
CVE-2026-76633 | High | 8.1 | 2026-08-20 | WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account passwo… |
CVE-2026-70383 | | 2026-08-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client. T… | |
CVE-2026-64972 | | 2026-08-20 | ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break o… | |
CVE-2026-64971 | | 2026-08-20 | ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScr… | |
CVE-2026-64970 | | 2026-08-20 | ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in th… | |
CVE-2026-64969 | | 2026-08-20 | ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can s… | |
CVE-2026-64968 | | 2026-08-20 | ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HT… | |
CVE-2026-64967 | | 2026-08-20 | A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended lo… | |
CVE-2026-64966 | | 2026-08-20 | ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a special… | |
CVE-2026-64965 | | 2026-08-20 | ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a… | |
CVE-2026-64964 | | 2026-08-20 | ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use… | |
CVE-2026-64963 | | 2026-08-20 | A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration op… | |
CVE-2026-64962 | | 2026-08-20 | ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, when visited by an… | |
CVE-2026-64961 | | 2026-08-20 | ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token val… | |
CVE-2026-64960 | | 2026-08-20 | ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in… | |
CVE-2026-15706 | Critical | 9.8 | 2026-08-20 | Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (B… |
CVE-2026-7485 | | 2026-08-20 | Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricte… | |
CVE-2026-77118 | | 2026-08-20 | A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output… | |
CVE-2026-76989 | Medium | 5.3 | 2026-08-20 | A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/… |
CVE-2026-76988 | Medium | 5.3 | 2026-08-20 | A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the f… |
CVE-2026-76987 | High | 7.3 | 2026-08-20 | A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrD… |
CVE-2026-74011 | High | 7.6 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. Th… |
CVE-2026-28164 | Critical | 9.6 | 2026-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addon… |
CVE-2026-28163 | Medium | 5.3 | 2026-08-20 | Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New… |
CVE-2026-21784 | Medium | 4.8 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and reso… |
CVE-2026-18482 | Critical | 9.8 | 2026-08-20 | Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSynta… |
CVE-2026-77085 | Medium | 6.5 | 2026-08-20 | n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL us… |
CVE-2026-77084 | High | 8.8 | 2026-08-20 | n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local gi… |
CVE-2026-77083 | Medium | 5.9 | 2026-08-20 | n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Fu… |
CVE-2026-77082 | Medium | 4.3 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch… |
CVE-2026-77081 | High | 7.1 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter i… |
CVE-2026-77080 | High | 8.8 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes fre… |
CVE-2026-77079 | High | 8.8 | 2026-08-20 | n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with… |
CVE-2026-77077 | High | 7.6 | 2026-08-20 | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis… |
CVE-2026-77076 | Medium | 6.5 | 2026-08-20 | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the conne… |