2026 CVEs (page 228)
Page 228 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41697 | Medium | 4.8 | 2026-06-10 | Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Que… |
CVE-2026-41696 | Medium | 5.9 | 2026-06-10 | Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An… |
CVE-2026-41695 | High | 7.5 | 2026-06-10 | Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed t… |
CVE-2026-41694 | Low | 3.7 | 2026-06-10 | Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attacker… |
CVE-2026-41008 | Medium | 6.1 | 2026-06-10 | Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious… |
CVE-2026-41003 | High | 7.6 | 2026-06-10 | An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affecte… |
CVE-2026-40993 | High | 7.3 | 2026-06-10 | An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store… |
CVE-2026-40991 | Medium | 5.9 | 2026-06-10 | When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tri… |
CVE-2026-40988 | High | 7.5 | 2026-06-10 | An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by w… |
CVE-2026-9754 | Medium | 6.5 | 2026-06-09 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command |
CVE-2026-9753 | High | 8.1 | 2026-06-09 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bou… |
CVE-2026-9752 | Medium | 6.5 | 2026-06-09 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polyg… |
CVE-2026-9751 | Medium | 5.5 | 2026-06-09 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. |
CVE-2026-9750 | Medium | 6.5 | 2026-06-09 | An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing du… |
CVE-2026-9749 | Medium | 6.5 | 2026-06-09 | This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving de… |
CVE-2026-9748 | Medium | 6.5 | 2026-06-09 | The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecuti… |
CVE-2026-9747 | Medium | 6.5 | 2026-06-09 | Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. |
CVE-2026-9746 | Medium | 6.5 | 2026-06-09 | When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are… |
CVE-2026-9743 | Medium | 6.5 | 2026-06-09 | In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued o… |
CVE-2026-9742 | High | 7.5 | 2026-06-09 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to s… |
CVE-2026-9741 | Medium | 6.5 | 2026-06-09 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results… |
CVE-2026-9740 | High | 7.5 | 2026-06-09 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. Th… |
CVE-2026-9735 | Medium | 5.5 | 2026-06-09 | MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is… |
CVE-2026-46433 | Medium | 6.5 | 2026-06-09 | lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet… |
CVE-2026-46374 | High | 7.5 | 2026-06-09 | SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrust… |
CVE-2026-46373 | High | 7.5 | 2026-06-09 | SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrust… |
CVE-2026-44963 | | 2026-06-09 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. | |
CVE-2026-47905 | Medium | 6.2 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could… |
CVE-2026-47904 | Medium | 6.2 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could… |
CVE-2026-47903 | Medium | 6.2 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation vulnerability. An attacker could exploit… |
CVE-2026-47902 | Medium | 6.2 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could… |
CVE-2026-34713 | High | 7.5 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could… |
CVE-2026-34712 | High | 7.5 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation vulnerability. An attacker could exploit… |
CVE-2026-34711 | High | 7.5 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could ex… |
CVE-2026-34657 | Medium | 5.5 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path… |
CVE-2026-34417 | Medium | 6.1 | 2026-06-09 | OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser b… |
CVE-2026-25860 | Medium | 6.1 | 2026-06-09 | OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary Jav… |
CVE-2026-48303 | Critical | 10.0 | 2026-06-09 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code… |
CVE-2026-48292 | High | 7.8 | 2026-06-09 | Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-48291 | High | 7.8 | 2026-06-09 | Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-47961 | Medium | 5.5 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2026-47960 | High | 7.4 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead… |
CVE-2026-47959 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code… |
CVE-2026-47955 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47952 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code e… |
CVE-2026-47938 | Critical | 10.0 | 2026-06-09 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in priv… |
CVE-2026-47937 | High | 7.7 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary… |
CVE-2026-47933 | Medium | 4.8 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged atta… |
CVE-2026-47932 | High | 8.8 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-47931 | High | 8.4 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-47930 | High | 8.1 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A lo… |
CVE-2026-47929 | High | 8.4 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-47928 | Critical | 9.6 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-47926 | Medium | 5.5 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2026-47925 | Medium | 5.5 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in an applicat… |
CVE-2026-47924 | Medium | 5.5 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory… |
CVE-2026-47923 | Medium | 5.5 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m… |
CVE-2026-47921 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47920 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47919 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47918 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47917 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47916 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47915 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47914 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47913 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47912 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in… |
CVE-2026-47911 | High | 7.8 | 2026-06-09 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code executi… |
CVE-2026-34416 | Medium | 6.1 | 2026-06-09 | OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser b… |
CVE-2026-25557 | Medium | 5.4 | 2026-06-09 | Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is refle… |
CVE-2026-11799 | High | 7.5 | 2026-06-09 | UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1. |
CVE-2026-6445 | | 2026-06-09 | A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low priv… | |
CVE-2026-6444 | | 2026-06-09 | A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality bey… | |
CVE-2026-48306 | High | 7.8 | 2026-06-09 | Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-48305 | High | 7.8 | 2026-06-09 | Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-47910 | Medium | 6.3 | 2026-06-09 | Dreamweaver Desktop versions 21.7 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. An attack… |
CVE-2026-47909 | Medium | 6.3 | 2026-06-09 | Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An atta… |
CVE-2026-47908 | High | 7.8 | 2026-06-09 | Dreamweaver Desktop versions 21.7 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in… |
CVE-2026-47907 | High | 8.6 | 2026-06-09 | Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-47906 | High | 8.6 | 2026-06-09 | Dreamweaver Desktop versions 21.7 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in arbitrary cod… |
CVE-2026-47106 | Medium | 5.4 | 2026-06-09 | Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerability in the course search functionality t… |
CVE-2026-34710 | High | 7.8 | 2026-06-09 | Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-34709 | High | 7.8 | 2026-06-09 | Substance3D - Sampler versions 6.0.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-32856 | Medium | 6.1 | 2026-06-09 | Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows unauthenticated attac… |
CVE-2026-11824 | High | 7.8 | 2026-06-09 | SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execu… |
CVE-2026-11822 | High | 7.8 | 2026-06-09 | SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory ex… |
CVE-2026-8863 | High | 7.8 | 2026-06-09 | Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the bo… |
CVE-2026-40639 | Medium | 5.7 | 2026-06-09 | Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this… |
CVE-2026-39170 | Medium | 6.3 | 2026-06-09 | SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php. |
CVE-2026-39169 | High | 7.5 | 2026-06-09 | SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php. |
CVE-2026-36823 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser… |
CVE-2026-36822 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the macAddr parameter of the formDelStaState function… |
CVE-2026-36821 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the picCropName parameter of the formCropAndSetWewifiPi… |
CVE-2026-36820 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAut… |
CVE-2026-36819 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the bindMACAddr parameter of the fromSetDhcpRules funct… |
CVE-2026-36818 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of the formAddWewifiW… |
CVE-2026-36817 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAu… |
CVE-2026-36816 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of the formAddWewifi… |
CVE-2026-36815 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the hostname parameter of the formSetNetCheckTools fun… |
CVE-2026-36813 | High | 7.5 | 2026-06-09 | Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picCropName parameter of the formCropAndSetWewifiP… |