2026 CVEs (page 216)
Page 216 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0154 | High | 8.8 | 2026-06-16 | In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote code execution with n… |
CVE-2026-0153 | High | 7.8 | 2026-06-16 | In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege w… |
CVE-2026-0152 | High | 7.8 | 2026-06-16 | In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic er… |
CVE-2026-0151 | High | 8.8 | 2026-06-16 | In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additio… |
CVE-2026-0150 | High | 7.8 | 2026-06-16 | In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of… |
CVE-2026-0149 | High | 8.8 | 2026-06-16 | In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional exec… |
CVE-2026-0148 | High | 8.8 | 2026-06-16 | In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code exe… |
CVE-2026-0147 | High | 8.8 | 2026-06-16 | In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a missing bounds check. This could lead to rem… |
CVE-2026-0146 | High | 8.8 | 2026-06-16 | In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote co… |
CVE-2026-0145 | Low | 3.3 | 2026-06-16 | In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional executio… |
CVE-2026-0144 | Medium | 6.5 | 2026-06-16 | In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service wit… |
CVE-2026-0143 | High | 7.8 | 2026-06-16 | In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privi… |
CVE-2026-0142 | Low | 3.3 | 2026-06-16 | In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure w… |
CVE-2026-0141 | Medium | 4.3 | 2026-06-16 | In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no a… |
CVE-2026-0140 | Medium | 4.3 | 2026-06-16 | In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additio… |
CVE-2026-0139 | High | 8.8 | 2026-06-16 | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileg… |
CVE-2026-0138 | High | 7.8 | 2026-06-16 | In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege… |
CVE-2026-0137 | High | 7.8 | 2026-06-16 | In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escala… |
CVE-2026-0136 | Medium | 6.5 | 2026-06-16 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privil… |
CVE-2026-0135 | High | 7.8 | 2026-06-16 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional execution privilege… |
CVE-2026-0134 | Low | 3.3 | 2026-06-16 | In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local… |
CVE-2026-0133 | High | 7.8 | 2026-06-16 | In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This coul… |
CVE-2026-0132 | High | 8.8 | 2026-06-16 | In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileg… |
CVE-2026-0131 | High | 7.3 | 2026-06-16 | In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no addit… |
CVE-2026-0130 | Low | 3.5 | 2026-06-16 | In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no a… |
CVE-2026-0129 | Low | 3.5 | 2026-06-16 | In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional exec… |
CVE-2026-0128 | Medium | 6.5 | 2026-06-16 | In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with n… |
CVE-2026-0127 | Medium | 6.5 | 2026-06-16 | In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote… |
CVE-2026-0126 | Critical | 9.8 | 2026-06-16 | In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privi… |
CVE-2026-0125 | High | 7.0 | 2026-06-16 | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addi… |
CVE-2026-53866 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved… |
CVE-2026-53865 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash c… |
CVE-2026-53864 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass… |
CVE-2026-53863 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a… |
CVE-2026-53862 | Medium | 4.2 | 2026-06-16 | OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested sco… |
CVE-2026-53861 | Medium | 6.6 | 2026-06-16 | OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers… |
CVE-2026-53860 | Medium | 4.2 | 2026-06-16 | OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation… |
CVE-2026-53859 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model… |
CVE-2026-53858 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependen… |
CVE-2026-53857 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries thr… |
CVE-2026-53856 | Medium | 5.5 | 2026-06-16 | OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permis… |
CVE-2026-53855 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional p… |
CVE-2026-53854 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard… |
CVE-2026-53853 | High | 8.3 | 2026-06-16 | OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowl… |
CVE-2026-53852 | Medium | 5.4 | 2026-06-16 | OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes… |
CVE-2026-53851 | Medium | 5.3 | 2026-06-16 | OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction not… |
CVE-2026-53850 | Medium | 5.5 | 2026-06-16 | OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the comma… |
CVE-2026-53849 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable… |
CVE-2026-53848 | Medium | 4.3 | 2026-06-16 | OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowl… |
CVE-2026-53847 | Medium | 5.4 | 2026-06-16 | OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write acces… |
CVE-2026-53846 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configura… |
CVE-2026-53845 | Medium | 4.3 | 2026-06-16 | OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverag… |
CVE-2026-53844 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory e… |
CVE-2026-53843 | High | 8.8 | 2026-06-16 | OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority… |
CVE-2026-53842 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through C… |
CVE-2026-53841 | Medium | 6.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated… |
CVE-2026-53840 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers duri… |
CVE-2026-50656 | High | 7.8 | 2026-06-16 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet &quo… |
CVE-2026-4367 | Medium | 5.5 | 2026-06-16 | A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a… |
CVE-2026-48775 | Medium | 6.8 | 2026-06-16 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and p… |
CVE-2026-47964 | High | 7.8 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-47963 | Medium | 5.5 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul… |
CVE-2026-47934 | Medium | 5.5 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul… |
CVE-2026-47927 | Medium | 5.5 | 2026-06-16 | DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul… |
CVE-2026-47749 | High | 7.8 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior… |
CVE-2026-47748 | Medium | 5.5 | 2026-06-16 | stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior… |
CVE-2026-10748 | | 2026-06-16 | An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the… | |
CVE-2026-53776 | Critical | 9.1 | 2026-06-16 | Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting o… |
CVE-2026-44932 | High | 8.8 | 2026-06-16 | Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server… |
CVE-2026-42089 | High | 8.6 | 2026-06-16 | Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0… |
CVE-2026-24228 | High | 7.8 | 2026-06-16 | NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerabil… |
CVE-2026-24155 | High | 7.8 | 2026-06-16 | NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to code execution, escal… |
CVE-2026-12003 | | 2026-06-16 | To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to loca… | |
CVE-2026-10649 | High | 8.6 | 2026-06-16 | A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By… |
CVE-2026-9307 | | 2026-06-16 | A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs o… | |
CVE-2026-48780 | High | 8.2 | 2026-06-16 | Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain a… |
CVE-2026-47684 | High | 7.7 | 2026-06-16 | Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex… |
CVE-2026-12398 | High | 7.5 | 2026-06-16 | A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref na… |
CVE-2026-11317 | | 2026-06-16 | A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when a crafted CIP message is sent. Devices… | |
CVE-2026-10831 | | 2026-06-16 | A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly valid… | |
CVE-2026-10640 | Medium | 4.2 | 2026-06-16 | Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-s… |
CVE-2026-10639 | Medium | 4.8 | 2026-06-16 | In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and… |
CVE-2026-10638 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and… |
CVE-2026-10637 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ow… |
CVE-2026-10636 | Low | 3.7 | 2026-06-16 | In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the pa… |
CVE-2026-0647 | | 2026-06-16 | An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenticated attacker to c… | |
CVE-2026-0646 | | 2026-06-16 | A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulnerability can result… | |
CVE-2026-9507 | | 2026-06-16 | A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the ini… | |
CVE-2026-53900 | Medium | 4.3 | 2026-06-16 | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject a… |
CVE-2026-53899 | Medium | 6.5 | 2026-06-16 | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging… |
CVE-2026-12330 | Medium | 5.4 | 2026-06-16 | Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 14… |
CVE-2026-12329 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. |
CVE-2026-12328 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed eviden… |
CVE-2026-12327 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corrupt… |
CVE-2026-12326 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-12325 | Medium | 6.5 | 2026-06-16 | Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, an… |
CVE-2026-12324 | High | 7.3 | 2026-06-16 | Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thu… |
CVE-2026-12323 | Medium | 5.4 | 2026-06-16 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12322 | Medium | 5.4 | 2026-06-16 | Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12321 | Medium | 5.4 | 2026-06-16 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |