2026 CVEs (page 23)
Page 23 of 660 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100882 | Low | 2.4 | 2026-09-27 | A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/component… |
CVE-2026-100881 | Low | 2.6 | 2026-09-27 | A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such… |
CVE-2026-96281 | Medium | 6.2 | 2026-09-27 | On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote re… |
CVE-2026-96280 | High | 7.5 | 2026-09-27 | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing und… |
CVE-2026-101090 | Critical | 9.8 | 2026-09-27 | Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/… |
CVE-2026-101089 | Low | 3.1 | 2026-09-27 | Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authen… |
CVE-2026-101088 | Medium | 5.3 | 2026-09-27 | Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains a… |
CVE-2026-101087 | Medium | 4.3 | 2026-09-27 | Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cov… |
CVE-2026-101086 | Medium | 6.5 | 2026-09-27 | Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:wri… |
CVE-2026-101085 | Medium | 6.5 | 2026-09-27 | Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger… |
CVE-2026-101084 | Critical | 9.6 | 2026-09-27 | obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP se… |
CVE-2026-101065 | Critical | 9.8 | 2026-09-27 | Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts… |
CVE-2026-101064 | High | 7.6 | 2026-09-27 | Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary UR… |
CVE-2026-101063 | Medium | 5.3 | 2026-09-27 | Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated at… |
CVE-2026-101062 | High | 8.8 | 2026-09-27 | Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authen… |
CVE-2026-100880 | Low | 3.5 | 2026-09-27 | A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/comm… |
CVE-2026-100879 | Medium | 4.3 | 2026-09-27 | A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of t… |
CVE-2026-100878 | Medium | 6.3 | 2026-09-27 | A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/j… |
CVE-2026-100877 | Medium | 4.3 | 2026-09-27 | A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an… |
CVE-2026-96279 | Medium | 6.5 | 2026-09-27 | A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remo… |
CVE-2026-100876 | Medium | 6.3 | 2026-09-27 | A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the fil… |
CVE-2026-100875 | High | 7.3 | 2026-09-27 | A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of t… |
CVE-2026-100874 | High | 7.3 | 2026-09-27 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file a… |
CVE-2026-100873 | Medium | 4.3 | 2026-09-27 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown func… |
CVE-2026-101061 | Medium | 4.7 | 2026-09-27 | utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes… |
CVE-2026-101060 | High | 8.2 | 2026-09-27 | python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool UR… |
CVE-2026-101059 | High | 7.1 | 2026-09-27 | utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to… |
CVE-2026-101058 | Medium | 6.9 | 2026-09-27 | python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback in… |
CVE-2026-101057 | Low | 3.1 | 2026-09-27 | utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration w… |
CVE-2026-101056 | Medium | 5.3 | 2026-09-27 | Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid sha… |
CVE-2026-101051 | Low | 3.1 | 2026-09-27 | Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected… |
CVE-2026-101048 | Medium | 5.4 | 2026-09-27 | Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without req… |
CVE-2026-101047 | Medium | 5.3 | 2026-09-27 | Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended rand… |
CVE-2026-101046 | Low | 3.1 | 2026-09-27 | Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activ… |
CVE-2026-101045 | High | 8.0 | 2026-09-27 | Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script ge… |
CVE-2026-101044 | High | 7.1 | 2026-09-27 | pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/n… |
CVE-2026-101043 | High | 7.4 | 2026-09-27 | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy setting… |
CVE-2026-88778 | High | 7.5 | 2026-09-27 | Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, be… |
CVE-2026-88777 | Critical | 9.8 | 2026-09-27 | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23… |
CVE-2026-88776 | Critical | 9.8 | 2026-09-27 | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23… |
CVE-2026-88775 | Critical | 9.8 | 2026-09-27 | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-… |
CVE-2026-88774 | High | 7.2 | 2026-09-27 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and… |
CVE-2026-88773 | Critical | 10.0 | 2026-09-27 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issu… |
CVE-2026-88772 | High | 8.1 | 2026-09-27 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and… |
CVE-2026-88771 | Critical | 9.8 | 2026-09-27 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, be… |
CVE-2026-101050 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is emp… |
CVE-2026-101049 | Medium | 6.5 | 2026-09-27 | Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attack… |
CVE-2026-101042 | Medium | 6.4 | 2026-09-27 | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Go… |
CVE-2026-101041 | | 2026-09-27 | The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition… | |
CVE-2026-101033 | Medium | 4.3 | 2026-09-27 | KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumer… |
CVE-2026-101032 | High | 7.0 | 2026-09-27 | navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters t… |
CVE-2026-100872 | High | 7.5 | 2026-09-27 | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals a… |
CVE-2026-100871 | High | 8.8 | 2026-09-27 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API… |
CVE-2026-100870 | High | 8.8 | 2026-09-27 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation… |
CVE-2026-100869 | Medium | 5.9 | 2026-09-27 | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed o… |
CVE-2026-100868 | Medium | 6.3 | 2026-09-27 | Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attacke… |
CVE-2026-100867 | Low | 3.3 | 2026-09-27 | spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers ca… |
CVE-2026-100866 | Low | 3.3 | 2026-09-27 | onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injec… |
CVE-2026-97165 | | 2026-09-27 | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to… | |
CVE-2026-97164 | | 2026-09-27 | Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` paramete… | |
CVE-2026-100749 | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are… | |
CVE-2026-100748 | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 | |
CVE-2026-100747 | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload… | |
CVE-2026-94417 | Medium | 5.3 | 2026-09-27 | When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certifica… |
CVE-2026-93304 | | 2026-09-27 | A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the cli… | |
CVE-2026-93302 | | 2026-09-27 | MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEE… | |
CVE-2026-89136 | | 2026-09-27 | When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allo… | |
CVE-2026-89135 | | 2026-09-27 | A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sib… | |
CVE-2026-89134 | | 2026-09-27 | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-a… | |
CVE-2026-89133 | | 2026-09-27 | wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when… | |
CVE-2026-89102 | Medium | 6.5 | 2026-09-27 | In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate… |
CVE-2026-15442 | | 2026-09-27 | In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use… | |
CVE-2026-94419 | Medium | 5.4 | 2026-09-27 | Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} in… |
CVE-2026-94418 | | 2026-09-27 | Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges th… | |
CVE-2026-100741 | Critical | 9.8 | 2026-09-27 | Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthe… |
CVE-2026-97319 | Medium | 6.8 | 2026-09-27 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, whic… |
CVE-2026-97227 | Medium | 5.9 | 2026-09-27 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, rely… |
CVE-2026-96899 | Medium | 6.8 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it… |
CVE-2026-96897 | Medium | 5.3 | 2026-09-27 | The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users… |
CVE-2026-96896 | High | 7.2 | 2026-09-27 | The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowi… |
CVE-2026-96895 | Medium | 6.8 | 2026-09-27 | The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when ren… |
CVE-2026-92995 | Medium | 5.3 | 2026-09-27 | The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to do… |
CVE-2026-92436 | Medium | 5.3 | 2026-09-27 | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-suppli… |
CVE-2026-89006 | Medium | 6.8 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with th… |
CVE-2026-89003 | Medium | 4.1 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the respons… |
CVE-2026-89001 | Medium | 4.9 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribu… |
CVE-2026-89000 | Medium | 4.1 | 2026-09-27 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL befor… |
CVE-2026-86841 | Medium | 4.7 | 2026-09-27 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly r… |
CVE-2026-86839 | Low | 3.8 | 2026-09-27 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its s… |
CVE-2026-86609 | High | 8.8 | 2026-09-27 | The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outpu… |
CVE-2026-85002 | Medium | 6.8 | 2026-09-27 | The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow user… |
CVE-2026-84069 | Medium | 5.3 | 2026-09-27 | The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it t… |
CVE-2026-82841 | Medium | 5.3 | 2026-09-27 | The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does… |
CVE-2026-81655 | High | 7.5 | 2026-09-27 | The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user un… |
CVE-2026-100746 | High | 7.3 | 2026-09-27 | A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the com… |
CVE-2026-100865 | High | 8.8 | 2026-09-27 | Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated… |
CVE-2026-100864 | High | 8.8 | 2026-09-27 | heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users… |
CVE-2026-100863 | Medium | 5.0 | 2026-09-27 | Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, th… |
CVE-2026-100862 | Medium | 4.9 | 2026-09-27 | heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook… |
CVE-2026-100861 | Medium | 5.0 | 2026-09-27 | heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF pr… |