2026 CVEs (page 217)
Page 217 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12320 | Medium | 4.3 | 2026-06-16 | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12319 | Medium | 6.5 | 2026-06-16 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12318 | High | 7.3 | 2026-06-16 | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12317 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12316 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12315 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12314 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12313 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-12312 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12311 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-12310 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12309 | Medium | 6.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12308 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12307 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12306 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12305 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12304 | Critical | 9.1 | 2026-06-16 | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbi… |
CVE-2026-12303 | Medium | 4.3 | 2026-06-16 | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12302 | Medium | 6.5 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-12301 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12300 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12299 | Medium | 5.4 | 2026-06-16 | JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and… |
CVE-2026-12298 | Medium | 5.4 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12297 | Critical | 9.6 | 2026-06-16 | Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 1… |
CVE-2026-12296 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird… |
CVE-2026-12295 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thun… |
CVE-2026-12294 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunder… |
CVE-2026-12293 | Critical | 9.8 | 2026-06-16 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12292 | High | 8.1 | 2026-06-16 | Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140… |
CVE-2026-12291 | High | 8.8 | 2026-06-16 | Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-12290 | High | 8.1 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 1… |
CVE-2026-12289 | High | 8.8 | 2026-06-16 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152… |
CVE-2026-8484 | | 2026-06-16 | A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call… | |
CVE-2026-40750 | Critical | 9.9 | 2026-06-16 | Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affect… |
CVE-2026-12225 | | 2026-06-16 | syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid cre… | |
CVE-2026-10829 | | 2026-06-16 | A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insuf… | |
CVE-2026-10828 | | 2026-06-16 | A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1… | |
CVE-2026-8442 | High | 8.1 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authoriza… |
CVE-2026-8176 | High | 7.5 | 2026-06-16 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up… |
CVE-2026-5416 | High | 8.8 | 2026-06-16 | Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability… |
CVE-2026-54198 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions. |
CVE-2026-54197 | Medium | 6.5 | 2026-06-16 | Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. |
CVE-2026-54191 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions. |
CVE-2026-54190 | Medium | 6.5 | 2026-06-16 | Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions. |
CVE-2026-52715 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. |
CVE-2026-52714 | Medium | 5.9 | 2026-06-16 | Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions. |
CVE-2026-52712 | High | 7.6 | 2026-06-16 | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. |
CVE-2026-52711 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. |
CVE-2026-49774 | Critical | 9.9 | 2026-06-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station… |
CVE-2026-49772 | Critical | 9.3 | 2026-06-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind S… |
CVE-2026-40809 | Medium | 6.5 | 2026-06-16 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-39581 | High | 8.5 | 2026-06-16 | Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions. |
CVE-2026-39574 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. |
CVE-2026-39490 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. |
CVE-2026-39437 | High | 7.1 | 2026-06-16 | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions. |
CVE-2026-2381 | Medium | 6.5 | 2026-06-16 | The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_p… |
CVE-2026-10825 | | 2026-06-16 | A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticate… | |
CVE-2026-8444 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions… |
CVE-2026-46331 | High | 7.8 | 2026-06-16 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() compute… |
CVE-2026-10093 | Medium | 6.4 | 2026-06-16 | The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all… |
CVE-2026-9187 | Medium | 5.3 | 2026-06-16 | The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a… |
CVE-2026-8443 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data A… |
CVE-2026-6933 | High | 8.8 | 2026-06-16 | The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due… |
CVE-2026-5149 | Medium | 6.5 | 2026-06-16 | The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content… |
CVE-2026-50255 | Medium | 6.7 | 2026-06-16 | Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. If this vulnerability is exploited, arbitrary code m… |
CVE-2026-10780 | Medium | 4.3 | 2026-06-16 | The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_bl… |
CVE-2026-10635 | Medium | 6.3 | 2026-06-16 | On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of… |
CVE-2026-6964 | Medium | 5.3 | 2026-06-16 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plu… |
CVE-2026-7273 | High | 8.8 | 2026-06-16 | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthe… |
CVE-2026-42014 | Medium | 6.6 | 2026-06-16 | A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability… |
CVE-2026-1767 | Medium | 5.6 | 2026-06-16 | A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit t… |
CVE-2026-1766 | Medium | 5.6 | 2026-06-16 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buff… |
CVE-2026-1765 | Medium | 5.6 | 2026-06-16 | A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow… |
CVE-2026-1764 | Medium | 5.6 | 2026-06-16 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags… |
CVE-2026-12162 | Medium | 5.5 | 2026-06-16 | Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social log… |
CVE-2026-12161 | High | 8.8 | 2026-06-16 | Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arb… |
CVE-2026-9262 | Medium | 6.5 | 2026-06-16 | Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9261 | Medium | 6.8 | 2026-06-16 | Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9260 | Medium | 6.2 | 2026-06-16 | Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9259 | Medium | 6.5 | 2026-06-16 | Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9258 | Medium | 6.5 | 2026-06-16 | Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-53430 | | 2026-06-15 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial… | |
CVE-2026-48854 | | 2026-06-15 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash… | |
CVE-2026-48853 | | 2026-06-15 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers… | |
CVE-2026-48723 | High | 7.8 | 2026-06-15 | The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS comma… |
CVE-2026-48599 | | 2026-06-15 | Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to ot… | |
CVE-2026-12205 | Critical | 9.1 | 2026-06-15 | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce… |
CVE-2026-5064 | | 2026-06-15 | Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of pri… | |
CVE-2026-48714 | Critical | 9.1 | 2026-06-15 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missi… |
CVE-2026-48713 | Critical | 9.1 | 2026-06-15 | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-h… |
CVE-2026-48157 | Medium | 6.1 | 2026-06-15 | Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpExceptio… |
CVE-2026-48017 | High | 8.8 | 2026-06-15 | DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that… |
CVE-2026-12087 | Critical | 9.1 | 2026-06-15 | Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the… |
CVE-2026-11832 | Critical | 9.1 | 2026-06-15 | Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time… |
CVE-2026-9691 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions. |
CVE-2026-52703 | Critical | 9.6 | 2026-06-15 | Unauthenticated Path Traversal in FastDup <= 2.7.2 versions. |
CVE-2026-52702 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. |
CVE-2026-52700 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. |
CVE-2026-52699 | High | 7.5 | 2026-06-15 | Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions. |
CVE-2026-52697 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions. |