2026 CVEs (page 225)
Page 225 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8464 | | 2026-06-11 | Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to read arbitrary files… | |
CVE-2026-7250 | High | 7.5 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certai… |
CVE-2026-6976 | Low | 3.7 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-6277 | Medium | 4.3 | 2026-06-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain co… |
CVE-2026-6269 | Medium | 5.4 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certai… |
CVE-2026-53912 | | 2026-06-11 | Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrant’s hashed passwo… | |
CVE-2026-53423 | | 2026-06-11 | Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of-service via BEAM a… | |
CVE-2026-4764 | | 2026-06-11 | A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with specific… | |
CVE-2026-3553 | Low | 3.1 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-1500 | Medium | 6.5 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certai… |
CVE-2026-10733 | Medium | 4.3 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have al… |
CVE-2026-10087 | High | 8.7 | 2026-06-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain co… |
CVE-2026-5497 | High | 7.5 | 2026-06-11 | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMedi… |
CVE-2026-53911 | | 2026-06-11 | Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patch… | |
CVE-2026-11850 | Medium | 5.0 | 2026-06-11 | An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function perfo… |
CVE-2026-53901 | | 2026-06-11 | Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied… | |
CVE-2026-41856 | High | 7.5 | 2026-06-11 | The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This… |
CVE-2026-41700 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authentica… |
CVE-2026-41699 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL r… |
CVE-2026-41001 | Medium | 5.3 | 2026-06-11 | Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is c… |
CVE-2026-41000 | Low | 3.7 | 2026-06-11 | Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections aga… |
CVE-2026-40999 | High | 8.6 | 2026-06-11 | When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSen… |
CVE-2026-40998 | High | 8.2 | 2026-06-11 | Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's defa… |
CVE-2026-40997 | Medium | 5.3 | 2026-06-11 | Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP cl… |
CVE-2026-40996 | Medium | 4.8 | 2026-06-11 | Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Secu… |
CVE-2026-40995 | Medium | 5.4 | 2026-06-11 | X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Sprin… |
CVE-2026-40994 | High | 8.2 | 2026-06-11 | Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on Request… |
CVE-2026-40992 | Medium | 5.0 | 2026-06-11 | Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properti… |
CVE-2026-40987 | High | 7.1 | 2026-06-11 | A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attack… |
CVE-2026-40986 | Medium | 4.8 | 2026-06-11 | Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scr… |
CVE-2026-10795 | High | 8.1 | 2026-06-11 | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the… |
CVE-2026-40985 | Medium | 6.4 | 2026-06-11 | Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4… |
CVE-2026-35273 | Critical | 9.8 | 2026-06-11 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are af… |
CVE-2026-2827 | Medium | 4.7 | 2026-06-11 | The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and in… |
CVE-2026-53465 | Medium | 6.2 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, a crafted multi-frame can result in a… |
CVE-2026-53464 | Medium | 4.0 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the… |
CVE-2026-53463 | Medium | 4.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect… |
CVE-2026-53462 | Medium | 5.9 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fai… |
CVE-2026-53461 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in t… |
CVE-2026-53460 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for ma… |
CVE-2026-52726 | High | 7.5 | 2026-06-10 | Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submod… |
CVE-2026-50223 | High | 8.8 | 2026-06-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource ed… |
CVE-2026-49219 | Medium | 5.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing o… |
CVE-2026-49218 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the… |
CVE-2026-48994 | Medium | 5.9 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check of a r… |
CVE-2026-48734 | Medium | 5.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file cou… |
CVE-2026-48733 | Medium | 4.7 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in th… |
CVE-2026-48724 | Medium | 5.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Flo… |
CVE-2026-47734 | Medium | 5.7 | 2026-06-10 | Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access… |
CVE-2026-47712 | Low | 3.3 | 2026-06-10 | Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, dulwich.porcelain.format_… |
CVE-2026-47342 | High | 8.8 | 2026-06-10 | A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz… |
CVE-2026-47213 | Medium | 6.5 | 2026-06-10 | Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In v… |
CVE-2026-47166 | Medium | 5.7 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can co… |
CVE-2026-47165 | Medium | 4.1 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel… |
CVE-2026-46703 | Critical | 9.6 | 2026-06-10 | Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prio… |
CVE-2026-46695 | Critical | 10.0 | 2026-06-10 | Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prio… |
CVE-2026-46693 | Medium | 4.1 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can co… |
CVE-2026-46692 | Medium | 4.1 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can co… |
CVE-2026-46645 | Medium | 4.3 | 2026-06-10 | SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible()… |
CVE-2026-46559 | Medium | 4.0 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an incorrect check in… |
CVE-2026-46557 | Medium | 6.2 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-23, due to a missing depth check a stack… |
CVE-2026-46521 | Medium | 5.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compre… |
CVE-2026-44693 | High | 8.8 | 2026-06-10 | Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vu… |
CVE-2026-42568 | Medium | 4.3 | 2026-06-10 | Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when c… |
CVE-2026-42563 | | 2026-06-10 | Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, Dulwich's `ProcessMergeDr… | |
CVE-2026-42558 | High | 7.6 | 2026-06-10 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain… |
CVE-2026-42305 | High | 8.8 | 2026-06-10 | Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write le… |
CVE-2026-53742 | Medium | 5.4 | 2026-06-10 | Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contr… |
CVE-2026-53741 | Medium | 5.4 | 2026-06-10 | Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field… |
CVE-2026-53740 | Medium | 5.4 | 2026-06-10 | Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a rep… |
CVE-2026-53739 | Medium | 4.3 | 2026-06-10 | Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or c… |
CVE-2026-53738 | High | 8.1 | 2026-06-10 | Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enab… |
CVE-2026-53737 | Medium | 6.1 | 2026-06-10 | Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected fe… |
CVE-2026-53736 | Medium | 4.3 | 2026-06-10 | Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attack… |
CVE-2026-53634 | Medium | 4.3 | 2026-06-10 | Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quic… |
CVE-2026-50131 | High | 8.6 | 2026-06-10 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg… |
CVE-2026-48110 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-co… |
CVE-2026-48108 | Medium | 5.3 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as… |
CVE-2026-48107 | Medium | 6.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a mali… |
CVE-2026-48011 | Low | 3.7 | 2026-06-10 | Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by perfo… |
CVE-2026-46705 | Medium | 5.3 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth… |
CVE-2026-46702 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets w… |
CVE-2026-46689 | | 2026-06-10 | Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a… | |
CVE-2026-46679 | High | 7.5 | 2026-06-10 | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthent… |
CVE-2026-46673 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocat… |
CVE-2026-46669 | High | 7.5 | 2026-06-10 | OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_hon… |
CVE-2026-46668 | | 2026-06-10 | SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, ca… | |
CVE-2026-46654 | | 2026-06-10 | Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transc… | |
CVE-2026-46625 | High | 7.5 | 2026-06-10 | JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with fo… |
CVE-2026-46523 | Medium | 6.2 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image ca… |
CVE-2026-46522 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check… |
CVE-2026-46520 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple… |
CVE-2026-45783 | High | 7.5 | 2026-06-10 | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @… |
CVE-2026-45664 | Medium | 5.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, because of a missing c… |
CVE-2026-45624 | Medium | 5.1 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a poly… |
CVE-2026-45384 | Medium | 6.1 | 2026-06-10 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, there is an arbitrary file overw… |
CVE-2026-45380 | Low | 3.6 | 2026-06-10 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in S… |
CVE-2026-45359 | Medium | 5.7 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-c… |
CVE-2026-45358 | Medium | 5.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the m… |
CVE-2026-45031 | Medium | 5.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, due to a missing check… |