2026 CVEs (page 233)
Page 233 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11793 | Medium | 4.9 | 2026-06-09 | A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte s… |
CVE-2026-11792 | Low | 3.3 | 2026-06-09 | A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a… |
CVE-2026-11790 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from store… |
CVE-2026-11789 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted passwo… |
CVE-2026-11788 | Medium | 5.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauth… |
CVE-2026-11787 | Medium | 5.0 | 2026-06-09 | A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer… |
CVE-2026-11786 | Low | 1.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during d… |
CVE-2026-11785 | Medium | 4.3 | 2026-06-09 | A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed… |
CVE-2026-46324 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_del_rcu for netlink hooks nft_netdev_unregister_hooks and… |
CVE-2026-46323 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the s… |
CVE-2026-46322 | High | 7.1 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_on… |
CVE-2026-46321 | High | 7.1 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on… |
CVE-2026-46320 | High | 7.4 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame sh… |
CVE-2026-46319 | High | 7.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in… |
CVE-2026-46318 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" This reverts commit ea52cb24c… |
CVE-2026-46317 | High | 8.8 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked… |
CVE-2026-46316 | Critical | 9.3 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic… |
CVE-2026-2638 | | 2026-06-09 | A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race conditio… | |
CVE-2026-11764 | | 2026-06-09 | When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not… | |
CVE-2026-49742 | | 2026-06-09 | Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Si… | |
CVE-2026-49741 | | 2026-06-09 | Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler… | |
CVE-2026-49740 | | 2026-06-09 | TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restriction… | |
CVE-2026-49738 | | 2026-06-09 | The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, cau… | |
CVE-2026-47352 | | 2026-06-09 | Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outsi… | |
CVE-2026-47351 | | 2026-06-09 | Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather inf… | |
CVE-2026-47350 | | 2026-06-09 | Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13… | |
CVE-2026-47349 | | 2026-06-09 | Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issu… | |
CVE-2026-47348 | | 2026-06-09 | Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization… | |
CVE-2026-47347 | | 2026-06-09 | Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed… | |
CVE-2026-47346 | | 2026-06-09 | Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework'… | |
CVE-2026-47343 | | 2026-06-09 | Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active… | |
CVE-2026-11607 | | 2026-06-09 | Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the i… | |
CVE-2026-52902 | Medium | 4.7 | 2026-06-09 | A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to cra… |
CVE-2026-4058 | Medium | 4.3 | 2026-06-09 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modi… |
CVE-2026-46749 | High | 7.5 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a sta… |
CVE-2026-46748 | High | 8.8 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_… |
CVE-2026-46747 | Medium | 4.3 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET… |
CVE-2026-46746 | High | 8.8 | 2026-06-09 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/upl… |
CVE-2026-41031 | High | 8.7 | 2026-06-09 | A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low… |
CVE-2026-24349 | High | 7.1 | 2026-06-09 | A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC… |
CVE-2026-10731 | | 2026-06-09 | SQL injection in the ‘two_steps_auth_code’ parameter processed by the ‘twoStepsAuthVerification’ function within the ‘/user-login’ endpoint. The two-factor aut… | |
CVE-2026-8677 | Medium | 6.4 | 2026-06-09 | The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML T… |
CVE-2026-8599 | Medium | 6.4 | 2026-06-09 | The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Camp… |
CVE-2026-8365 | High | 8.8 | 2026-06-09 | The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 datab… |
CVE-2026-7542 | Medium | 6.5 | 2026-06-09 | The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions 7.0 to 7.0.10. This is due to three compounding design… |
CVE-2026-6899 | Medium | 5.6 | 2026-06-09 | Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper o… |
CVE-2026-49818 | Medium | 6.5 | 2026-06-09 | The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named wi… |
CVE-2026-46315 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores… |
CVE-2026-34905 | Medium | 6.5 | 2026-06-09 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted ques… |
CVE-2026-34033 | Medium | 5.4 | 2026-06-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0… |
CVE-2026-34031 | Medium | 6.5 | 2026-06-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficien… |
CVE-2026-33582 | Medium | 6.5 | 2026-06-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could t… |
CVE-2026-28262 | Medium | 6.0 | 2026-06-09 | Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attack… |
CVE-2026-25699 | Medium | 6.1 | 2026-06-09 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-r… |
CVE-2026-25688 | Medium | 6.1 | 2026-06-09 | Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response conten… |
CVE-2026-11616 | High | 8.8 | 2026-06-09 | The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax… |
CVE-2026-9698 | Critical | 9.8 | 2026-06-09 | DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were s… |
CVE-2026-5068 | High | 7.6 | 2026-06-09 | A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enab… |
CVE-2026-44083 | Critical | 9.8 | 2026-06-09 | An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability… |
CVE-2026-41986 | Low | 2.4 | 2026-06-09 | Logic bypass vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41985 | Medium | 5.1 | 2026-06-09 | UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2026-41984 | Medium | 5.2 | 2026-06-09 | UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2026-41983 | Medium | 4.3 | 2026-06-09 | Null pointer dereference vulnerability in the browser module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41982 | Medium | 6.4 | 2026-06-09 | Race condition vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41981 | Medium | 5.3 | 2026-06-09 | Out-of-bounds write vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41977 | Medium | 5.0 | 2026-06-09 | DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41976 | Medium | 6.6 | 2026-06-09 | Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-41974 | Low | 3.6 | 2026-06-09 | Permission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41973 | Medium | 5.9 | 2026-06-09 | Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-41972 | Medium | 5.4 | 2026-06-09 | Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-8981 | Low | 3.5 | 2026-06-09 | The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block tem… |
CVE-2026-5067 | Critical | 9.8 | 2026-06-09 | A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header… |
CVE-2026-4986 | Medium | 5.3 | 2026-06-09 | The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticat… |
CVE-2026-41539 | Medium | 6.1 | 2026-06-09 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulner… |
CVE-2026-11572 | High | 8.8 | 2026-06-09 | Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git… |
CVE-2026-9662 | High | 8.1 | 2026-06-09 | The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insuffici… |
CVE-2026-9185 | High | 7.5 | 2026-06-09 | The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the… |
CVE-2026-8977 | Medium | 6.4 | 2026-06-09 | The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninja_gdpr_ajax_actions' AJAX action in versions up to, a… |
CVE-2026-8940 | Medium | 4.3 | 2026-06-09 | The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or in… |
CVE-2026-8910 | Medium | 6.1 | 2026-06-09 | The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or… |
CVE-2026-8909 | Medium | 4.3 | 2026-06-09 | The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to missing or incorrect no… |
CVE-2026-8907 | Medium | 6.1 | 2026-06-09 | The WP-Ultimate-Map plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing nonce valida… |
CVE-2026-8904 | Medium | 4.3 | 2026-06-09 | The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vulnerable to Cross-Site Request Forgery… |
CVE-2026-8902 | Medium | 4.3 | 2026-06-09 | The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing o… |
CVE-2026-8895 | Medium | 6.4 | 2026-06-09 | The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up to, and including… |
CVE-2026-8883 | Medium | 6.4 | 2026-06-09 | The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmicalc' shortcode in versions up to, and inc… |
CVE-2026-8882 | Medium | 6.4 | 2026-06-09 | The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and includ… |
CVE-2026-8880 | Medium | 6.4 | 2026-06-09 | The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes) of the romancart_b… |
CVE-2026-8841 | Medium | 6.4 | 2026-06-09 | The Extra Settings for RocketChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rocketchat' shortcode's 'title' attribute in versi… |
CVE-2026-8499 | Medium | 5.3 | 2026-06-09 | The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This… |
CVE-2026-7662 | Medium | 6.4 | 2026-06-09 | The ePaperFlip Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'publicationid' attribute of the `epaperflip_embed` shortcod… |
CVE-2026-41980 | Medium | 5.5 | 2026-06-09 | Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-41979 | Medium | 5.5 | 2026-06-09 | Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect integrity and confidentiality. |
CVE-2026-41978 | Medium | 4.4 | 2026-06-09 | Permission control vulnerability in the clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-41975 | Medium | 6.3 | 2026-06-09 | Permission management vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2026-41855 | High | 8.1 | 2026-06-09 | In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.Jackso… |
CVE-2026-41854 | Medium | 4.2 | 2026-06-09 | Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a serve… |
CVE-2026-41853 | Medium | 5.3 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 thro… |
CVE-2026-41852 | Low | 3.7 | 2026-06-09 | A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only… |
CVE-2026-41851 | Medium | 5.3 | 2026-06-09 | Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation o… |