2026 CVEs (page 218)
Page 218 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20314 | Medium | 5.0 | 2026-08-19 | A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticat… |
CVE-2026-20302 | Medium | 6.1 | 2026-08-19 | A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to… |
CVE-2026-20232 | Medium | 5.4 | 2026-08-19 | A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to c… |
CVE-2026-20231 | Critical | 9.9 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-20177 | Medium | 5.3 | 2026-08-19 | A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attac… |
CVE-2026-20030 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-64852 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the api… | |
CVE-2026-64851 | | 2026-08-19 | Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav S… | |
CVE-2026-64850 | | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class… | |
CVE-2026-63408 | High | 7.5 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenti… |
CVE-2026-63407 | High | 8.2 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddlewa… |
CVE-2026-62673 | | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore… | |
CVE-2026-62672 | | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::reg… | |
CVE-2026-62671 | Medium | 5.4 | 2026-08-19 | Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top… |
CVE-2026-62670 | Medium | 6.3 | 2026-08-19 | Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method… |
CVE-2026-62669 | High | 7.4 | 2026-08-19 | Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only t… |
CVE-2026-62668 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController… | |
CVE-2026-62667 | High | 8.1 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::gen… |
CVE-2026-62666 | High | 8.8 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::creat… |
CVE-2026-61842 | Medium | 6.5 | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and pe… |
CVE-2026-61690 | Medium | 6.5 | 2026-08-19 | Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchi… |
CVE-2026-61607 | Medium | 4.6 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media… |
CVE-2026-53654 | | 2026-08-19 | Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an… | |
CVE-2026-46343 | High | 7.2 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receivin… |
CVE-2026-44254 | Medium | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in… |
CVE-2026-44253 | Medium | 4.9 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protoc… |
CVE-2026-44252 | High | 8.8 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege rea… |
CVE-2026-19672 | | 2026-08-19 | The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to… | |
CVE-2026-18430 | | 2026-08-19 | HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's c… | |
CVE-2026-16819 | High | 7.7 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check ti… |
CVE-2026-76614 | Medium | 4.3 | 2026-08-19 | OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive r… |
CVE-2026-76203 | | 2026-08-19 | Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user… | |
CVE-2026-75956 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Pagination values were not strictly typed. Arra… | |
CVE-2026-75955 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XM… | |
CVE-2026-75954 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2… | |
CVE-2026-75953 | High | 7.5 | 2026-08-19 | Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_i… |
CVE-2026-75952 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/… | |
CVE-2026-75951 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3 | |
CVE-2026-75950 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-suppli… | |
CVE-2026-75949 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controll… | |
CVE-2026-71961 | High | 8.8 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS comma… |
CVE-2026-71960 | Critical | 9.1 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin… |
CVE-2026-71176 | High | 8.8 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi… |
CVE-2026-67268 | Medium | 6.5 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker w… |
CVE-2026-67267 | Medium | 5.5 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low… |
CVE-2026-67266 | Medium | 5.5 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Authorization vulnerability. A low privileged attacker with local access could potenti… |
CVE-2026-58565 | High | 8.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentiall… |
CVE-2026-58564 | High | 7.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could p… |
CVE-2026-58562 | High | 7.3 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentiall… |
CVE-2026-56797 | High | 7.3 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local acc… |
CVE-2026-56796 | Medium | 6.6 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged a… |
CVE-2026-54793 | Medium | 4.6 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabi… |
CVE-2026-53477 | High | 7.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with l… |
CVE-2026-53452 | Medium | 5.3 | 2026-08-19 | Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthent… |
CVE-2026-53451 | Critical | 9.8 | 2026-08-19 | Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthent… |
CVE-2026-52889 | Critical | 9.8 | 2026-08-19 | Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, C… |
CVE-2026-52834 | High | 7.3 | 2026-08-19 | jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow lengt… |
CVE-2026-52792 | | 2026-08-19 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ex… | |
CVE-2026-50149 | Medium | 6.5 | 2026-08-19 | Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combinatio… |
CVE-2026-49817 | High | 7.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access coul… |
CVE-2026-49816 | High | 7.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access coul… |
CVE-2026-49289 | High | 7.5 | 2026-08-19 | The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transform… |
CVE-2026-49283 | High | 8.7 | 2026-08-19 | The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive… |
CVE-2026-49255 | High | 8.8 | 2026-08-19 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in sr… |
CVE-2026-49253 | High | 7.1 | 2026-08-19 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly wi… |
CVE-2026-48711 | High | 7.0 | 2026-08-19 | SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyComman… |
CVE-2026-47187 | Critical | 9.3 | 2026-08-19 | SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative… |
CVE-2026-45742 | High | 7.5 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup… |
CVE-2026-45741 | High | 7.5 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002… |
CVE-2026-45274 | | 2026-08-19 | MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handler… | |
CVE-2026-45273 | | 2026-08-19 | MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserv… | |
CVE-2026-45272 | | 2026-08-19 | MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in we… | |
CVE-2026-44829 | High | 8.8 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux… |
CVE-2026-40509 | Medium | 4.3 | 2026-08-19 | OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded u… |
CVE-2026-40508 | Medium | 5.4 | 2026-08-19 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers wit… |
CVE-2026-40507 | Medium | 6.1 | 2026-08-19 | OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is r… |
CVE-2026-32802 | Medium | 5.3 | 2026-08-19 | Dell PowerPath, version 7.2 through to 8.0 SP1, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could pote… |
CVE-2026-23501 | High | 7.2 | 2026-08-19 | Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') v… |
CVE-2026-18756 | | 2026-08-19 | HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacke… | |
CVE-2026-18526 | | 2026-08-19 | HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow. | |
CVE-2026-16818 | High | 7.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-16817 | High | 7.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference. |
CVE-2026-16816 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of speci… |
CVE-2026-16814 | High | 8.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow. |
CVE-2026-16706 | High | 7.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write. |
CVE-2026-16703 | High | 7.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management. |
CVE-2026-16690 | High | 7.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-16686 | High | 8.2 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication. |
CVE-2026-16656 | Critical | 9.8 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication. |
CVE-2026-15961 | Medium | 5.2 | 2026-08-19 | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive inf… |
CVE-2026-15078 | High | 8.1 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS ce… |
CVE-2026-15068 | Critical | 9.9 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of s… |
CVE-2026-15065 | Critical | 9.1 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate… |
CVE-2026-15061 | High | 8.2 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal. |
CVE-2026-14970 | High | 7.5 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow. |
CVE-2026-76245 | | 2026-08-19 | stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens… | |
CVE-2026-76244 | | 2026-08-19 | stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loop… | |
CVE-2026-76243 | | 2026-08-19 | stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, an… | |
CVE-2026-76242 | | 2026-08-19 | stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On n… | |
CVE-2026-76241 | | 2026-08-19 | stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setti… |