2026 CVEs (page 23)
Page 23 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13168 | Medium | 6.5 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and abov… |
CVE-2026-12976 | Medium | 6.5 | 2026-08-12 | The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's… |
CVE-2026-64954 | High | 8.2 | 2026-08-12 | Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permissio… |
CVE-2026-12235 | Medium | 6.3 | 2026-08-12 | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF extension. In llex… |
CVE-2026-12234 | High | 7.8 | 2026-08-12 | The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_m… |
CVE-2026-12233 | Medium | 5.9 | 2026-08-12 | The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-fil… |
CVE-2026-12232 | Medium | 6.1 | 2026-08-12 | The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no rang… |
CVE-2026-9318 | Medium | 5.4 | 2026-08-12 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScr… |
CVE-2026-19588 | Medium | 6.5 | 2026-08-12 | Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. |
CVE-2026-19587 | Medium | 6.5 | 2026-08-12 | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation. |
CVE-2026-18961 | High | 8.1 | 2026-08-12 | The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unveri… |
CVE-2026-73122 | High | 7.7 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent fr… |
CVE-2026-72526 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Applic… |
CVE-2026-70398 | Critical | 9.6 | 2026-08-12 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, refer… |
CVE-2026-66878 | High | 7.7 | 2026-08-12 | A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription r… |
CVE-2026-64927 | Medium | 6.4 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles… |
CVE-2026-6484 | High | 8.2 | 2026-08-12 | In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution. |
CVE-2026-68450 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_root() allocates a ma… | |
CVE-2026-68449 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning The hand-rolled… | |
CVE-2026-68448 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c (… | |
CVE-2026-68447 | High | 7.1 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies… |
CVE-2026-68446 | High | 7.8 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and… |
CVE-2026-68445 | High | 7.8 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects… |
CVE-2026-68444 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffa_partition_info_ge… | |
CVE-2026-68443 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_sto… | |
CVE-2026-68442 | High | 7.8 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_ma… |
CVE-2026-68441 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a… | |
CVE-2026-68440 | High | 7.8 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeprom_hostif() alway… |
CVE-2026-68439 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() mt76_conna… | |
CVE-2026-68438 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d ("smp: Improve s… | |
CVE-2026-68437 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geometry jobs with a pai… | |
CVE-2026-68436 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time (… | |
CVE-2026-68435 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loa… | |
CVE-2026-68434 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Commit… | |
CVE-2026-68433 | High | 8.6 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg-… |
CVE-2026-68432 | High | 8.8 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() ope… |
CVE-2026-68431 | Critical | 9.1 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the mini… |
CVE-2026-68430 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUG_ON() There's no need to crash the kernel for this ca… | |
CVE-2026-68429 | | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A h… | |
CVE-2026-73250 | | 2026-08-11 | Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced install… | |
CVE-2026-73249 | High | 7.5 | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/sr… |
CVE-2026-73248 | | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar fi… | |
CVE-2026-73247 | High | 8.6 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction… |
CVE-2026-73246 | High | 7.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java… |
CVE-2026-73245 | Medium | 6.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management… |
CVE-2026-68067 | Critical | 9.8 | 2026-08-11 | The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching… |
CVE-2026-67568 | Critical | 9.1 | 2026-08-11 | The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could resu… |
CVE-2026-67558 | High | 7.4 | 2026-08-11 | The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, w… |
CVE-2026-66875 | High | 8.8 | 2026-08-11 | In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silen… |
CVE-2026-66340 | Medium | 5.3 | 2026-08-11 | The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. A… |
CVE-2026-66098 | Medium | 6.5 | 2026-08-11 | The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. A… |
CVE-2026-64934 | Medium | 4.3 | 2026-08-11 | The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version… |
CVE-2026-5917 | Critical | 9.6 | 2026-08-11 | libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote… |
CVE-2026-29036 | High | 7.5 | 2026-08-11 | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils… |
CVE-2026-19560 | High | 8.8 | 2026-08-11 | Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-19559 | High | 8.8 | 2026-08-11 | Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-19558 | High | 7.5 | 2026-08-11 | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbi… |
CVE-2026-19557 | High | 8.3 | 2026-08-11 | Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-19556 | High | 8.8 | 2026-08-11 | Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-18710 | Medium | 6.5 | 2026-08-11 | A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log o… |
CVE-2026-71290 | Critical | 9.1 | 2026-08-11 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when us… |
CVE-2026-66832 | Medium | 6.5 | 2026-08-11 | When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string para… |
CVE-2026-66154 | High | 8.3 | 2026-08-11 | An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions… |
CVE-2026-66150 | High | 7.8 | 2026-08-11 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access… |
CVE-2026-66149 | High | 7.8 | 2026-08-11 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access… |
CVE-2026-66148 | Medium | 6.3 | 2026-08-11 | An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows l… |
CVE-2026-66147 | Critical | 9.4 | 2026-08-11 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker… |
CVE-2026-63177 | High | 7.1 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the r… |
CVE-2026-63134 | Medium | 5.4 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but crea… |
CVE-2026-63133 | Medium | 6.5 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, director… |
CVE-2026-55676 | High | 8.8 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores… |
CVE-2026-48765 | Critical | 9.9 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readabl… |
CVE-2026-48763 | High | 8.2 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/st… |
CVE-2026-48762 | Medium | 5.4 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()`… |
CVE-2026-29035 | Medium | 6.5 | 2026-08-11 | CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attacker… |
CVE-2026-19579 | Medium | 5.4 | 2026-08-11 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_ad… |
CVE-2026-19550 | Medium | 4.3 | 2026-08-11 | A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permissi… |
CVE-2026-18634 | High | 8.4 | 2026-08-11 | An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A… |
CVE-2026-15606 | High | 8.8 | 2026-08-11 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the pl… |
CVE-2026-14863 | High | 8.8 | 2026-08-11 | FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code executio… |
CVE-2026-73283 | Low | 2.5 | 2026-08-11 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. |
CVE-2026-73282 | Medium | 4.8 | 2026-08-11 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. |
CVE-2026-73281 | Low | 3.5 | 2026-08-11 | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use ke… |
CVE-2026-73244 | Medium | 5.3 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/jav… |
CVE-2026-73243 | Medium | 5.8 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted… |
CVE-2026-73242 | | 2026-08-11 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage fun… | |
CVE-2026-73241 | | 2026-08-11 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-su… | |
CVE-2026-73235 | Medium | 6.1 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XM… |
CVE-2026-73234 | High | 7.8 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates… |
CVE-2026-73233 | | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemCo… | |
CVE-2026-73232 | High | 7.5 | 2026-08-11 | ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response… |
CVE-2026-73231 | High | 7.8 | 2026-08-11 | Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows a… |
CVE-2026-73230 | | 2026-08-11 | Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32… | |
CVE-2026-73229 | Medium | 4.3 | 2026-08-11 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRende… |
CVE-2026-73036 | Medium | 4.4 | 2026-08-11 | Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to… |
CVE-2026-73034 | Critical | 9.8 | 2026-08-11 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by i… |
CVE-2026-73032 | Critical | 9.6 | 2026-08-11 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code fro… |
CVE-2026-73031 | High | 8.7 | 2026-08-11 | telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sendi… |
CVE-2026-71845 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credent… |
CVE-2026-71475 | Medium | 5.0 | 2026-08-11 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This oc… |