2026 CVEs (page 22)
Page 22 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-68760 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may bypass authentication under specific cache conditions. |
CVE-2026-68757 | High | 7.5 | 2026-08-12 | A user with access to a valid SAML response may impersonate another user under specific conditions. |
CVE-2026-68756 | Medium | 6.6 | 2026-08-12 | A party with write access to stored session data may affect JFrog Artifactory under specific conditions. |
CVE-2026-68755 | Medium | 4.3 | 2026-08-12 | A bundle writer may create misleading release promotion information under specific conditions. |
CVE-2026-68754 | Medium | 6.5 | 2026-08-12 | A repository publisher without delete permission may modify protected package content under specific conditions. |
CVE-2026-68753 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. |
CVE-2026-68752 | High | 7.2 | 2026-08-12 | A Project Resource Manager may gain broader administrative privileges under specific conditions. |
CVE-2026-67287 | | 2026-08-12 | Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances… | |
CVE-2026-67286 | | 2026-08-12 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can cr… | |
CVE-2026-66382 | Medium | 4.3 | 2026-08-12 | An authenticated user may write files outside the intended Artifactory work directory under specific conditions. |
CVE-2026-66381 | Medium | 5.3 | 2026-08-12 | A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions. |
CVE-2026-66380 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. |
CVE-2026-66379 | Medium | 4.3 | 2026-08-12 | An authenticated user may view private Puppet module metadata without repository read access. |
CVE-2026-66378 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access private NuGet metadata under specific conditions. |
CVE-2026-66377 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may access restricted repository information under specific conditions. |
CVE-2026-66376 | Medium | 4.2 | 2026-08-12 | Credentials for a deleted user may remain valid for a short period under specific conditions. |
CVE-2026-66375 | High | 8.1 | 2026-08-12 | A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. |
CVE-2026-50561 | Critical | 9.4 | 2026-08-12 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mec… |
CVE-2026-49349 | Medium | 6.8 | 2026-08-12 | regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A pre… |
CVE-2026-49262 | Low | 3.0 | 2026-08-12 | In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request For… |
CVE-2026-47234 | Medium | 4.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and… |
CVE-2026-47233 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/invent… |
CVE-2026-18171 | | 2026-08-12 | Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is ad… | |
CVE-2026-14479 | Medium | 5.5 | 2026-08-12 | A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offse… |
CVE-2026-14478 | High | 7.8 | 2026-08-12 | A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into… |
CVE-2026-67285 | | 2026-08-12 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform inc… | |
CVE-2026-47232 | Medium | 4.3 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bun… |
CVE-2026-47231 | High | 8.1 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the acto… |
CVE-2026-47230 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause s… |
CVE-2026-47229 | Medium | 5.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing br… |
CVE-2026-47228 | Medium | 5.2 | 2026-08-12 | Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores… |
CVE-2026-47227 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspo… |
CVE-2026-16999 | Medium | 6.3 | 2026-08-12 | Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This… |
CVE-2026-71408 | Medium | 5.3 | 2026-08-12 | A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all version… |
CVE-2026-71407 | Medium | 5.6 | 2026-08-12 | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypas… |
CVE-2026-70468 | High | 8.1 | 2026-08-12 | A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 t… |
CVE-2026-70467 | Low | 3.8 | 2026-08-12 | A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all… |
CVE-2026-70466 | Medium | 5.3 | 2026-08-12 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWe… |
CVE-2026-57858 | High | 8.9 | 2026-08-12 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticat… |
CVE-2026-53996 | High | 7.0 | 2026-08-12 | NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the… |
CVE-2026-47226 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanent… |
CVE-2026-26035 | Critical | 9.8 | 2026-08-12 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through… |
CVE-2026-70560 | Medium | 5.4 | 2026-08-12 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inje… |
CVE-2026-70465 | High | 8.1 | 2026-08-12 | A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7… |
CVE-2026-18044 | Low | 3.7 | 2026-08-12 | The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its pr… |
CVE-2026-17008 | Medium | 5.3 | 2026-08-12 | The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an o… |
CVE-2026-16990 | Medium | 5.3 | 2026-08-12 | The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment… |
CVE-2026-16747 | Medium | 6.5 | 2026-08-12 | The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shor… |
CVE-2026-16621 | Medium | 5.3 | 2026-08-12 | The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its P… |
CVE-2026-15213 | Medium | 5.3 | 2026-08-12 | The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauth… |
CVE-2026-15045 | Medium | 6.5 | 2026-08-12 | The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance d… |
CVE-2026-11325 | High | 8.8 | 2026-08-12 | Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue… |
CVE-2026-68868 | Medium | 6.5 | 2026-08-12 | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the… |
CVE-2026-67284 | | 2026-08-12 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-re… | |
CVE-2026-64955 | Medium | 6.1 | 2026-08-12 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velocira… |
CVE-2026-64952 | Medium | 6.5 | 2026-08-12 | The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "in… |
CVE-2026-64951 | Low | 3.5 | 2026-08-12 | A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server proc… |
CVE-2026-18663 | Medium | 5.9 | 2026-08-12 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection… |
CVE-2026-18652 | Medium | 4.9 | 2026-08-12 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requ… |
CVE-2026-67283 | | 2026-08-12 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-… | |
CVE-2026-67282 | | 2026-08-12 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using t… | |
CVE-2026-19566 | High | 7.5 | 2026-08-12 | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts an… |
CVE-2026-19426 | High | 8.2 | 2026-08-12 | POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system. |
CVE-2026-66659 | Critical | 9.3 | 2026-08-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This… |
CVE-2026-19594 | High | 8.1 | 2026-08-12 | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two re… |
CVE-2026-19217 | Medium | 5.4 | 2026-08-12 | The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could… |
CVE-2026-19073 | Medium | 5.3 | 2026-08-12 | The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not… |
CVE-2026-19052 | Medium | 4.3 | 2026-08-12 | The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is pu… |
CVE-2026-19050 | Medium | 6.4 | 2026-08-12 | The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, bef… |
CVE-2026-18962 | Medium | 4.3 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it process… |
CVE-2026-18943 | Medium | 6.5 | 2026-08-12 | The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscri… |
CVE-2026-18789 | High | 7.5 | 2026-08-12 | The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to t… |
CVE-2026-18474 | High | 8.6 | 2026-08-12 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection expl… |
CVE-2026-18391 | Critical | 9.8 | 2026-08-12 | The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage… |
CVE-2026-18366 | Critical | 9.8 | 2026-08-12 | The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already mad… |
CVE-2026-18230 | High | 8.1 | 2026-08-12 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated… |
CVE-2026-18057 | High | 8.1 | 2026-08-12 | The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with… |
CVE-2026-18049 | High | 7.5 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an o… |
CVE-2026-18048 | High | 7.5 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint… |
CVE-2026-18046 | Medium | 4.3 | 2026-08-12 | The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores it… |
CVE-2026-18035 | Medium | 5.3 | 2026-08-12 | The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read… |
CVE-2026-17013 | Medium | 6.1 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which cou… |
CVE-2026-16977 | High | 8.1 | 2026-08-12 | The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query bu… |
CVE-2026-16737 | Medium | 5.3 | 2026-08-12 | The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one… |
CVE-2026-16538 | Critical | 9.1 | 2026-08-12 | The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowi… |
CVE-2026-16294 | High | 7.1 | 2026-08-12 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a serve… |
CVE-2026-16253 | High | 7.5 | 2026-08-12 | The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unau… |
CVE-2026-16066 | Medium | 5.4 | 2026-08-12 | The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users wi… |
CVE-2026-16051 | Critical | 9.8 | 2026-08-12 | The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect… |
CVE-2026-15388 | Medium | 4.3 | 2026-08-12 | The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST rou… |
CVE-2026-15249 | Medium | 5.4 | 2026-08-12 | The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a… |
CVE-2026-15039 | Critical | 9.8 | 2026-08-12 | The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload a… |
CVE-2026-14925 | High | 7.5 | 2026-08-12 | The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated a… |
CVE-2026-14859 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated user… |
CVE-2026-14858 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subs… |
CVE-2026-14857 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification… |
CVE-2026-13613 | High | 8.8 | 2026-08-12 | The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authentic… |
CVE-2026-13612 | Medium | 4.3 | 2026-08-12 | The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level user… |
CVE-2026-13177 | Medium | 4.3 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and abo… |
CVE-2026-13171 | High | 8.2 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to… |